From 5d6fa52b8985f8068314aba26878a1d7d5cb84e5 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 6 May 2026 20:42:32 +0300 Subject: feat: flip swap mechanism — MD as primary, RST as override (Phase 1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is the first of three phases inverting the per-page swap mechanism so MD becomes the canonical primary and RST becomes the rare override. Phase 1 — file renames + conf.py exclude_patterns flip only: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 254 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 254 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty comment-only since no pages need the RST fallback right now - conf.py exclude_patterns flipped: rst-*.rst is now excluded by default instead of md-*.md - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt (Phase 2 will rewrite swap_sources.py to produce these names; for now no swap script runs because overrides list is empty) Phase 2 (next commit on this branch) will rewrite scripts/swap_sources.py with inverted rename direction, delete scripts/import_myst.py + tests, and update tests/test_swap_sources.py for the new semantics. Phase 3 will be the cleanup pass and ready-for-review flip. Generated by robots https://vyos.io --- docs/configuration/firewall/bridge.md | 685 +++++++++ docs/configuration/firewall/bridge.rst | 573 ------- docs/configuration/firewall/flowtables.md | 176 +++ docs/configuration/firewall/flowtables.rst | 188 --- docs/configuration/firewall/global-options.md | 186 +++ docs/configuration/firewall/global-options.rst | 182 --- docs/configuration/firewall/groups.md | 477 ++++++ docs/configuration/firewall/groups.rst | 457 ------ docs/configuration/firewall/index.md | 278 ++++ docs/configuration/firewall/index.rst | 267 ---- docs/configuration/firewall/ipv4.md | 1517 +++++++++++++++++++ docs/configuration/firewall/ipv4.rst | 1305 ---------------- docs/configuration/firewall/ipv6.md | 1567 ++++++++++++++++++++ docs/configuration/firewall/ipv6.rst | 1302 ---------------- docs/configuration/firewall/md-bridge.md | 685 --------- docs/configuration/firewall/md-flowtables.md | 176 --- docs/configuration/firewall/md-global-options.md | 186 --- docs/configuration/firewall/md-groups.md | 477 ------ docs/configuration/firewall/md-index.md | 278 ---- docs/configuration/firewall/md-ipv4.md | 1517 ------------------- docs/configuration/firewall/md-ipv6.md | 1567 -------------------- docs/configuration/firewall/md-zone.md | 201 --- docs/configuration/firewall/rst-bridge.rst | 573 +++++++ docs/configuration/firewall/rst-flowtables.rst | 188 +++ docs/configuration/firewall/rst-global-options.rst | 182 +++ docs/configuration/firewall/rst-groups.rst | 457 ++++++ docs/configuration/firewall/rst-index.rst | 267 ++++ docs/configuration/firewall/rst-ipv4.rst | 1305 ++++++++++++++++ docs/configuration/firewall/rst-ipv6.rst | 1302 ++++++++++++++++ docs/configuration/firewall/rst-zone.rst | 205 +++ docs/configuration/firewall/zone.md | 201 +++ docs/configuration/firewall/zone.rst | 205 --- 32 files changed, 9566 insertions(+), 9566 deletions(-) create mode 100644 docs/configuration/firewall/bridge.md delete mode 100644 docs/configuration/firewall/bridge.rst create mode 100644 docs/configuration/firewall/flowtables.md delete mode 100644 docs/configuration/firewall/flowtables.rst create mode 100644 docs/configuration/firewall/global-options.md delete mode 100644 docs/configuration/firewall/global-options.rst create mode 100644 docs/configuration/firewall/groups.md delete mode 100644 docs/configuration/firewall/groups.rst create mode 100644 docs/configuration/firewall/index.md delete mode 100644 docs/configuration/firewall/index.rst create mode 100644 docs/configuration/firewall/ipv4.md delete mode 100644 docs/configuration/firewall/ipv4.rst create mode 100644 docs/configuration/firewall/ipv6.md delete mode 100644 docs/configuration/firewall/ipv6.rst delete mode 100644 docs/configuration/firewall/md-bridge.md delete mode 100644 docs/configuration/firewall/md-flowtables.md delete mode 100644 docs/configuration/firewall/md-global-options.md delete mode 100644 docs/configuration/firewall/md-groups.md delete mode 100644 docs/configuration/firewall/md-index.md delete mode 100644 docs/configuration/firewall/md-ipv4.md delete mode 100644 docs/configuration/firewall/md-ipv6.md delete mode 100644 docs/configuration/firewall/md-zone.md create mode 100644 docs/configuration/firewall/rst-bridge.rst create mode 100644 docs/configuration/firewall/rst-flowtables.rst create mode 100644 docs/configuration/firewall/rst-global-options.rst create mode 100644 docs/configuration/firewall/rst-groups.rst create mode 100644 docs/configuration/firewall/rst-index.rst create mode 100644 docs/configuration/firewall/rst-ipv4.rst create mode 100644 docs/configuration/firewall/rst-ipv6.rst create mode 100644 docs/configuration/firewall/rst-zone.rst create mode 100644 docs/configuration/firewall/zone.md delete mode 100644 docs/configuration/firewall/zone.rst (limited to 'docs/configuration/firewall') diff --git a/docs/configuration/firewall/bridge.md b/docs/configuration/firewall/bridge.md new file mode 100644 index 00000000..f0e94f9e --- /dev/null +++ b/docs/configuration/firewall/bridge.md @@ -0,0 +1,685 @@ +--- +lastproofread: '2026-03-28' +--- + +(firewall-configuration)= + +# Bridge Firewall Configuration + +## Overview + +Learn more about bridge firewall configuration +and related op-mode commands. + +The following commands are covered in this section: + +```{cfgcmd} set firewall bridge \ +``` + +From the main structure defined in +{doc}`Firewall Overview` +in this section you can find detailed information only for the next part +of the general structure: + +```none +- set firewall + * bridge + - forward + + filter + - input + + filter + - output + + filter + - prerouting + + filter + - name + + custom_name +``` + +Traffic that is received by the router on an interface that is a member of a +bridge is processed on the **Bridge Layer**. Before the bridge decision is +made, all packets are analyzed at **Prerouting**. First filters can be applied +here, and also rules for ignoring connection tracking system can be configured. +The relevant configuration that acts in **prerouting** is: + + +- `set firewall bridge prerouting filter ...`. + + +For traffic that needs to be switched internally by the bridge, the base +chain is **forward**, and its base command for filtering is `set firewall +bridge forward filter ...`, which happens in stage 4, highlighted with red +color. + + +:::{figure} /_static/images/firewall-bridge-forward.webp +::: + + +For traffic destined to the router itself or that needs to be routed +(assuming a layer3 bridge is configured), the base chain is **input**, and the +base command is `set firewall bridge input filter ...` and the path is: + + +:::{figure} /_static/images/firewall-bridge-input.webp +::: + + +If it's not dropped, then the packet is sent to **IP Layer**, and will be +processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again +the {doc}`general packet flow diagram` if +needed. + + +For traffic that originates from the bridge itself, the base chain is +**output**, and the base command is `set firewall bridge output filter +...`, and the path is: + + +:::{figure} /_static/images/firewall-bridge-output.webp +::: + + +Custom bridge firewall chains can be created with the command `set firewall +bridge name ...`. To use such a custom chain, a rule with action jump +and the appropriate target must be defined in a base chain. + + +## Bridge Rules + + +For firewall filtering, firewall rules need to be created. Each rule is +numbered, has an action to apply if the rule is matched, and the ability +to specify multiple matching criteria. Data packets go through the rules +from 1 - 999999, so order is crucial. At the first match the action of the +rule will be executed. + + +### Actions + + +If a rule is defined, an action must also be defined for it. This tells the +firewall what to do if all matching criteria in the rule are met. + + +In firewall bridge rules, the action can be: + + +- `accept`: accept the packet. +- `continue`: continue parsing next rule. +- `drop`: drop the packet. +- `jump`: jump to another custom chain. +- `return`: Return from the current chain and continue at the next rule + of the last chain. +- `queue`: Enqueue packet to userspace. +- `notrack`: ignore connection tracking system. This action is only + available in prerouting chain. + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> action [accept | continue | drop | jump | queue | return] +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> action [accept | continue | drop | jump | queue | return] +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> action [accept | continue | drop | jump | queue | return] +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> action [accept | continue | drop | jump | notrack | queue | return] +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> action [accept | continue | drop | jump | queue | return] + +This required setting defines the action of the current rule. If action is +set to jump, then jump-target is also needed. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> jump-target \ +``` + +If action is set to ``queue``, use next command to specify the queue +target. Range is also supported: + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> queue \<0-65535\> + +Also, if action is set to ``queue``, use next command to specify the queue +options. Possible options are ``bypass`` and ``fanout``: +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> queue-options fanout +``` + +Also, **default-action** is an action that takes place whenever a packet does +not match any rule in its chain. For base chains, possible options for +**default-action** are **accept** or **drop**. + +```{cfgcmd} set firewall bridge forward filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall bridge input filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall bridge output filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall bridge prerouting filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall bridge name \ default-action [accept | continue | drop | jump | reject | return] + +This sets the default action of the rule-set if a packet does not match +any of the rules in that chain. If default-action is set to ``jump``, then +``default-jump-target`` is also needed. Note that for base chains, default +action can only be set to ``accept`` or ``drop``, while on custom chains +more actions are available. +``` + +```{cfgcmd} set firewall bridge name \ default-jump-target \ + +To be used only when ``default-action`` is set to ``jump``. Use this +command to specify jump target for default rule. +``` +:::{note} +**Important note about default-actions:** +If the default action for any base chain is not defined, then the default +action is set to **accept** for that chain. For custom chains, if the +default action is not defined, then the default-action is set to **drop**. +::: + + +### Firewall Logs + + +You can enable logging for every firewall rule. If enabled, other log options +can be configured. + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log + +Enable logging for the matched packet. If this configuration command is not +present, then the log is not enabled. +``` + +```{cfgcmd} set firewall bridge forward filter default-log +``` + +```{cfgcmd} set firewall bridge input filter default-log +``` + +```{cfgcmd} set firewall bridge output filter default-log +``` + +```{cfgcmd} set firewall bridge prerouting filter default-log +``` + +```{cfgcmd} set firewall bridge name \ default-log + +Use this command to enable the logging of the default action on +the specified chain. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] + +Define log-level. Only applicable if rule log is enabled. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options group \<0-65535\> + +Define the log group to send messages to. Only applicable if rule log is +enabled. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options snapshot-length \<0-9000\> + +Define length of packet payload to include in netlink message. Only +applicable if rule log is enabled and the log group is defined. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options queue-threshold \<0-65535\> + +Define the number of packets to queue inside the kernel before sending them +to userspace. Only applicable if rule log is enabled and the log group is +defined. +``` + +### Firewall Description + + +You can define a description for reference for every custom chain. + +```{cfgcmd} set firewall bridge name \ description \ + +Provide a rule-set description to a custom firewall chain. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> description \ + +Provide a description for each rule. +``` + +### Rule Status + + +By default, when you define a rule, it is enabled. In some cases, it is +useful to disable the rule instead of removing it. + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> disable + +Command for disabling a rule but keep it in the configuration. +``` + +### Matching criteria + + +There are many matching criteria against which a packet can be tested. Refer +to {doc}`IPv4` and +{doc}`IPv6` matching criteria for more details. + + +Since bridges operate at layer 2, both matchers for IPv4 and IPv6 are +supported in bridge firewall configuration. Same applies to firewall groups. + + +Same specific matching criteria that can be used in bridge firewall are +described in this section: + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] + +Match based on the Ethernet type of the packet. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] + +Match based on the Ethernet type of the packet when it is VLAN tagged. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> vlan id \<0-4096\> +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> vlan id \<0-4096\> +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> vlan id \<0-4096\> +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> vlan id \<0-4096\> +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> vlan id \<0-4096\> + +Match based on VLAN identifier. Range is also supported. +``` + +```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> vlan priority \<0-7\> +``` + +```{cfgcmd} set firewall bridge input filter rule \<1-999999\> vlan priority \<0-7\> +``` + +```{cfgcmd} set firewall bridge output filter rule \<1-999999\> vlan priority \<0-7\> +``` + +```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> vlan priority \<0-7\> +``` + +```{cfgcmd} set firewall bridge name \ rule \<1-999999\> vlan priority \<0-7\> + +Match based on VLAN priority (Priority Code Point - PCP). Range is also +supported. +``` + +### Packet Modifications + + +Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify +packets before they are sent out. This feature provides more flexibility in +packet handling. + +```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set dscp \<0-63\> + +Set a specific value of Differentiated Services Codepoint (DSCP). +``` + +```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set mark \<1-2147483647\> + +Set a specific packet mark value. +``` + +```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set tcp-mss \<500-1460\> + +Set the TCP-MSS (TCP maximum segment size) for the connection. +``` + +```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set ttl \<0-255\> + +Set the TTL (Time to Live) value. +``` + +```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set hop-limit \<0-255\> + +Set hop limit value. +``` + +```{cfgcmd} set firewall bridge [forward | output] filter rule \<1-999999\> set connection-mark \<0-2147483647\> + +Set connection mark value. +``` + +### Use IP firewall + +By default, for switched traffic, only the rules defined under `set firewall +bridge` are applied. There are two global-options that can be configured in +order to force deeper analysis of the packet on the IP layer. These options +are: + +```{cfgcmd} set firewall global-options apply-to-bridged-traffic ipv4 + +This command enables the IPv4 firewall for bridged traffic. If this option +is used, packets are also parsed by rules defined in ``set firewall ipv4 +...`` +``` + +```{cfgcmd} set firewall global-options apply-to-bridged-traffic ipv6 + +This command enables the IPv6 firewall for bridged traffic. If this option +is used, packets are also parsed by rules defined in ``set firewall ipv6 +...`` +``` + +## Operation-mode Firewall +### Rule-set overview + +In this section you can find all useful firewall op-mode commands. +General commands for firewall configuration, counter and statistics: + +```{opcmd} show firewall +``` + +```{opcmd} show firewall summary +``` + +```{opcmd} show firewall statistics +``` + +And, to print only bridge firewall information: + +```{opcmd} show firewall bridge +``` + +```{opcmd} show firewall bridge forward filter +``` + +```{opcmd} show firewall bridge forward filter rule \ +``` + +```{opcmd} show firewall bridge name \ +``` + +```{opcmd} show firewall bridge name \ rule \ +``` + +### Show Firewall log + +```{opcmd} show log firewall +``` + +```{opcmd} show log firewall bridge +``` + +```{opcmd} show log firewall bridge forward +``` + +```{opcmd} show log firewall bridge forward filter +``` + +```{opcmd} show log firewall bridge name \ +``` + +```{opcmd} show log firewall bridge forward filter rule \ +``` + +```{opcmd} show log firewall bridge name \ rule \ + +Show the logs of all firewall; show all bridge firewall logs; show all logs +for forward hook; show all logs for forward hook and priority filter; show +all logs for particular custom chain; show logs for specific Rule-Set. +``` + +### Example + +Configuration example: + +```none +set firewall bridge forward filter default-action 'drop' +set firewall bridge forward filter default-log +set firewall bridge forward filter rule 10 action 'continue' +set firewall bridge forward filter rule 10 inbound-interface name 'eth2' +set firewall bridge forward filter rule 10 vlan id '22' +set firewall bridge forward filter rule 20 action 'drop' +set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT' +set firewall bridge forward filter rule 20 vlan id '60' +set firewall bridge forward filter rule 30 action 'jump' +set firewall bridge forward filter rule 30 jump-target 'TEST' +set firewall bridge forward filter rule 30 outbound-interface name '!eth1' +set firewall bridge forward filter rule 35 action 'accept' +set firewall bridge forward filter rule 35 vlan id '11' +set firewall bridge forward filter rule 40 action 'continue' +set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11' +set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66' +set firewall bridge name TEST default-action 'accept' +set firewall bridge name TEST default-log +set firewall bridge name TEST rule 10 action 'continue' +set firewall bridge name TEST rule 10 log +set firewall bridge name TEST rule 10 vlan priority '0' +``` + +And op-mode commands: + +```none +vyos@BRI:~$ show firewall bridge +Rulesets bridge Information + +--------------------------------- +bridge Firewall "forward filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- --------------------------------------------------------------------- +10 continue all 0 0 iifname "eth2" vlan id 22 continue +20 drop all 0 0 iifname @I_TRUNK-RIGHT vlan id 60 +30 jump all 2130 170688 oifname != "eth1" jump NAME_TEST +35 accept all 2080 168616 vlan id 11 accept +40 continue all 0 0 ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66 continue +default drop all 0 0 + +--------------------------------- +bridge Firewall "name TEST" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- -------------------------------------------------- +10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue +default accept all 2130 170688 + +vyos@BRI:~$ +vyos@BRI:~$ show firewall bridge name TEST +Ruleset Information + +--------------------------------- +bridge Firewall "name TEST" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- -------------------------------------------------- +10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue +default accept all 2130 170688 + +vyos@BRI:~$ +``` + +Inspect logs: + +```none +vyos@BRI:~$ show log firewall bridge +Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 +Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 +Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 +... +vyos@BRI:~$ show log firewall bridge forward filter +Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 +Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 +``` diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst deleted file mode 100644 index 53775514..00000000 --- a/docs/configuration/firewall/bridge.rst +++ /dev/null @@ -1,573 +0,0 @@ -:lastproofread: 2026-03-28 - -.. _firewall-configuration: - -############################# -Bridge Firewall Configuration -############################# - -******** -Overview -******** - -Learn more about bridge firewall configuration -and related op-mode commands. - -The following commands are covered in this section: - -.. cfgcmd:: set firewall bridge - -From the main structure defined in -:doc:`Firewall Overview` -in this section you can find detailed information only for the next part -of the general structure: - -.. code-block:: none - - - set firewall - * bridge - - forward - + filter - - input - + filter - - output - + filter - - prerouting - + filter - - name - + custom_name - -Traffic that is received by the router on an interface that is a member of a -bridge is processed on the **Bridge Layer**. Before the bridge decision is -made, all packets are analyzed at **Prerouting**. First filters can be applied -here, and also rules for ignoring connection tracking system can be configured. -The relevant configuration that acts in **prerouting** is: - - * ``set firewall bridge prerouting filter ...``. - -For traffic that needs to be switched internally by the bridge, the base -chain is **forward**, and its base command for filtering is ``set firewall -bridge forward filter ...``, which happens in stage 4, highlighted with red -color. - -.. figure:: /_static/images/firewall-bridge-forward.* - -For traffic destined to the router itself or that needs to be routed -(assuming a layer3 bridge is configured), the base chain is **input**, and the -base command is ``set firewall bridge input filter ...`` and the path is: - -.. figure:: /_static/images/firewall-bridge-input.* - -If it's not dropped, then the packet is sent to **IP Layer**, and will be -processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again -the :doc:`general packet flow diagram` if -needed. - -For traffic that originates from the bridge itself, the base chain is -**output**, and the base command is ``set firewall bridge output filter -...``, and the path is: - -.. figure:: /_static/images/firewall-bridge-output.* - -Custom bridge firewall chains can be created with the command ``set firewall -bridge name ...``. To use such a custom chain, a rule with action jump -and the appropriate target must be defined in a base chain. - -************ -Bridge Rules -************ - -For firewall filtering, firewall rules need to be created. Each rule is -numbered, has an action to apply if the rule is matched, and the ability -to specify multiple matching criteria. Data packets go through the rules -from 1 - 999999, so order is crucial. At the first match the action of the -rule will be executed. - -Actions -======= - -If a rule is defined, an action must also be defined for it. This tells the -firewall what to do if all matching criteria in the rule are met. - -In firewall bridge rules, the action can be: - - * ``accept``: accept the packet. - - * ``continue``: continue parsing next rule. - - * ``drop``: drop the packet. - - * ``jump``: jump to another custom chain. - - * ``return``: Return from the current chain and continue at the next rule - of the last chain. - - * ``queue``: Enqueue packet to userspace. - - * ``notrack``: ignore connection tracking system. This action is only - available in prerouting chain. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> action - [accept | continue | drop | jump | queue | return] -.. cfgcmd:: set firewall bridge input filter rule <1-999999> action - [accept | continue | drop | jump | queue | return] -.. cfgcmd:: set firewall bridge output filter rule <1-999999> action - [accept | continue | drop | jump | queue | return] -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> action - [accept | continue | drop | jump | notrack | queue | return] -.. cfgcmd:: set firewall bridge name rule <1-999999> action - [accept | continue | drop | jump | queue | return] - - This required setting defines the action of the current rule. If action is - set to jump, then jump-target is also needed. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall bridge name rule <1-999999> - jump-target - - If action is set to ``queue``, use next command to specify the queue - target. Range is also supported: - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall bridge name rule <1-999999> - queue <0-65535> - - Also, if action is set to ``queue``, use next command to specify the queue - options. Possible options are ``bypass`` and ``fanout``: - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall bridge name rule <1-999999> - queue-options bypass - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall bridge name rule <1-999999> - queue-options fanout - -Also, **default-action** is an action that takes place whenever a packet does -not match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -.. cfgcmd:: set firewall bridge forward filter default-action - [accept | drop] -.. cfgcmd:: set firewall bridge input filter default-action - [accept | drop] -.. cfgcmd:: set firewall bridge output filter default-action - [accept | drop] -.. cfgcmd:: set firewall bridge prerouting filter default-action - [accept | drop] -.. cfgcmd:: set firewall bridge name default-action - [accept | continue | drop | jump | reject | return] - - This sets the default action of the rule-set if a packet does not match - any of the rules in that chain. If default-action is set to ``jump``, then - ``default-jump-target`` is also needed. Note that for base chains, default - action can only be set to ``accept`` or ``drop``, while on custom chains - more actions are available. - -.. cfgcmd:: set firewall bridge name default-jump-target - - To be used only when ``default-action`` is set to ``jump``. Use this - command to specify jump target for default rule. - -.. note:: **Important note about default-actions:** - If the default action for any base chain is not defined, then the default - action is set to **accept** for that chain. For custom chains, if the - default action is not defined, then the default-action is set to **drop**. - -Firewall Logs -============= - -You can enable logging for every firewall rule. If enabled, other log options -can be configured. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> log -.. cfgcmd:: set firewall bridge input filter rule <1-999999> log -.. cfgcmd:: set firewall bridge output filter rule <1-999999> log -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> log -.. cfgcmd:: set firewall bridge name rule <1-999999> log - - Enable logging for the matched packet. If this configuration command is not - present, then the log is not enabled. - -.. cfgcmd:: set firewall bridge forward filter default-log -.. cfgcmd:: set firewall bridge input filter default-log -.. cfgcmd:: set firewall bridge output filter default-log -.. cfgcmd:: set firewall bridge prerouting filter default-log -.. cfgcmd:: set firewall bridge name default-log - - Use this command to enable the logging of the default action on - the specified chain. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] - - Define log-level. Only applicable if rule log is enabled. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options group <0-65535> - - Define the log group to send messages to. Only applicable if rule log is - enabled. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options snapshot-length <0-9000> - - Define length of packet payload to include in netlink message. Only - applicable if rule log is enabled and the log group is defined. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options queue-threshold <0-65535> - - Define the number of packets to queue inside the kernel before sending them - to userspace. Only applicable if rule log is enabled and the log group is - defined. - -Firewall Description -==================== - -You can define a description for reference for every custom chain. - -.. cfgcmd:: set firewall bridge name description - - Provide a rule-set description to a custom firewall chain. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - description -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - description -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - description -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - description -.. cfgcmd:: set firewall bridge name rule <1-999999> - description - - Provide a description for each rule. - -Rule Status -=========== - -By default, when you define a rule, it is enabled. In some cases, it is -useful to disable the rule instead of removing it. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> disable -.. cfgcmd:: set firewall bridge input filter rule <1-999999> disable -.. cfgcmd:: set firewall bridge output filter rule <1-999999> disable -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> disable -.. cfgcmd:: set firewall bridge name rule <1-999999> disable - - Command for disabling a rule but keep it in the configuration. - -Matching criteria -================= - -There are many matching criteria against which a packet can be tested. Refer -to :doc:`IPv4` and -:doc:`IPv6` matching criteria for more details. - -Since bridges operate at layer 2, both matchers for IPv4 and IPv6 are -supported in bridge firewall configuration. Same applies to firewall groups. - -Same specific matching criteria that can be used in bridge firewall are -described in this section: - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge input filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge output filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge name rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] - - Match based on the Ethernet type of the packet. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -.. cfgcmd:: set firewall bridge name rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] - - Match based on the Ethernet type of the packet when it is VLAN tagged. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan id - <0-4096> -.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan id - <0-4096> -.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan id - <0-4096> -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan id - <0-4096> -.. cfgcmd:: set firewall bridge name rule <1-999999> vlan id - <0-4096> - - Match based on VLAN identifier. Range is also supported. - -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan priority - <0-7> -.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan priority - <0-7> -.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan priority - <0-7> -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan priority - <0-7> -.. cfgcmd:: set firewall bridge name rule <1-999999> vlan priority - <0-7> - - Match based on VLAN priority (Priority Code Point - PCP). Range is also - supported. - -Packet Modifications -==================== - -Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify -packets before they are sent out. This feaure provides more flexibility in -packet handling. - -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set dscp <0-63> - - Set a specific value of Differentiated Services Codepoint (DSCP). - -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set mark <1-2147483647> - - Set a specific packet mark value. - -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set tcp-mss <500-1460> - - Set the TCP-MSS (TCP maximum segment size) for the connection. - -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set ttl <0-255> - - Set the TTL (Time to Live) value. - -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set hop-limit <0-255> - - Set hop limit value. - -.. cfgcmd:: set firewall bridge [forward | output] filter - rule <1-999999> set connection-mark <0-2147483647> - - Set connection mark value. - - -Use IP firewall -=============== - -By default, for switched traffic, only the rules defined under ``set firewall -bridge`` are applied. There are two global-options that can be configured in -order to force deeper analysis of the packet on the IP layer. These options -are: - -.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv4 - - This command enables the IPv4 firewall for bridged traffic. If this option - is used, packets are also parsed by rules defined in ``set firewall ipv4 - ...`` - -.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv6 - - This command enables the IPv6 firewall for bridged traffic. If this option - is used, packets are also parsed by rules defined in ``set firewall ipv6 - ...`` - -*********************** -Operation-mode Firewall -*********************** - -Rule-set overview -================= - -In this section you can find all useful firewall op-mode commands. - -General commands for firewall configuration, counter and statistics: - -.. opcmd:: show firewall -.. opcmd:: show firewall summary -.. opcmd:: show firewall statistics - -And, to print only bridge firewall information: - -.. opcmd:: show firewall bridge -.. opcmd:: show firewall bridge forward filter -.. opcmd:: show firewall bridge forward filter rule -.. opcmd:: show firewall bridge name -.. opcmd:: show firewall bridge name rule - -Show Firewall log -================= - -.. opcmd:: show log firewall -.. opcmd:: show log firewall bridge -.. opcmd:: show log firewall bridge forward -.. opcmd:: show log firewall bridge forward filter -.. opcmd:: show log firewall bridge name -.. opcmd:: show log firewall bridge forward filter rule -.. opcmd:: show log firewall bridge name rule - - Show the logs of all firewall; show all bridge firewall logs; show all logs - for forward hook; show all logs for forward hook and priority filter; show - all logs for particular custom chain; show logs for specific Rule-Set. - -Example -======= - -Configuration example: - -.. code-block:: none - - set firewall bridge forward filter default-action 'drop' - set firewall bridge forward filter default-log - set firewall bridge forward filter rule 10 action 'continue' - set firewall bridge forward filter rule 10 inbound-interface name 'eth2' - set firewall bridge forward filter rule 10 vlan id '22' - set firewall bridge forward filter rule 20 action 'drop' - set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT' - set firewall bridge forward filter rule 20 vlan id '60' - set firewall bridge forward filter rule 30 action 'jump' - set firewall bridge forward filter rule 30 jump-target 'TEST' - set firewall bridge forward filter rule 30 outbound-interface name '!eth1' - set firewall bridge forward filter rule 35 action 'accept' - set firewall bridge forward filter rule 35 vlan id '11' - set firewall bridge forward filter rule 40 action 'continue' - set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11' - set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66' - set firewall bridge name TEST default-action 'accept' - set firewall bridge name TEST default-log - set firewall bridge name TEST rule 10 action 'continue' - set firewall bridge name TEST rule 10 log - set firewall bridge name TEST rule 10 vlan priority '0' - -And op-mode commands: - -.. code-block:: none - - vyos@BRI:~$ show firewall bridge - Rulesets bridge Information - - --------------------------------- - bridge Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- --------------------------------------------------------------------- - 10 continue all 0 0 iifname "eth2" vlan id 22 continue - 20 drop all 0 0 iifname @I_TRUNK-RIGHT vlan id 60 - 30 jump all 2130 170688 oifname != "eth1" jump NAME_TEST - 35 accept all 2080 168616 vlan id 11 accept - 40 continue all 0 0 ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66 continue - default drop all 0 0 - - --------------------------------- - bridge Firewall "name TEST" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- -------------------------------------------------- - 10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue - default accept all 2130 170688 - - vyos@BRI:~$ - vyos@BRI:~$ show firewall bridge name TEST - Ruleset Information - - --------------------------------- - bridge Firewall "name TEST" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- -------------------------------------------------- - 10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue - default accept all 2130 170688 - - vyos@BRI:~$ - -Inspect logs: - -.. stop_vyoslinter - -.. code-block:: none - - vyos@BRI:~$ show log firewall bridge - Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 - Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 - Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 - ... - vyos@BRI:~$ show log firewall bridge forward filter - Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 - Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 - -.. start_vyoslinter diff --git a/docs/configuration/firewall/flowtables.md b/docs/configuration/firewall/flowtables.md new file mode 100644 index 00000000..24d0675e --- /dev/null +++ b/docs/configuration/firewall/flowtables.md @@ -0,0 +1,176 @@ +--- +lastproofread: '2026-03-30' +--- + +(firewall-flowtables-configuration)= + +# Flowtables Firewall Configuration + +```{include} /_include/need_improvement.txt +``` + + +## Overview + +This section provides information on firewall configuration for flowtables. + +```{cfgcmd} set firewall flowtable ... +``` + +To learn about the general traffic flow in VyOS firewalls, +see {doc}`Firewall `. + +```none +- set firewall + * flowtable + - custom_flow_table + + ... +``` + +Flowtables let you define a fastpath through the flowtable datapath. +Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP) +protocols. + +:::{figure} /_static/images/firewall-flowtable-packet-flow.webp +::: + +After the first packet successfully traverses the IP forwarding path (black +circles path), you can offload subsequent packets to the flowtable through your +ruleset. You specify when to add a flow to the flowtable during forward +filtering (red circle number 6). + +When a packet finds a matching entry in the flowtable (flowtable hit), the +system transmits it to the output netdevice. This means packets bypass the +classic IP forwarding path and use the **Fast Path** (orange circles path). +As a result, you do not see these packets from any Netfilter hooks after +ingress. If no matching entry exists in the flowtable (flowtable miss), the +packet traverses the classic IP forwarding path. + +:::{note} +**Flowtable Reference:** + +::: + +## Flowtable Configuration + +To use flowtables, you need to configure the following: +> - Create a flowtable that includes the interfaces +> that are going to be used by the flowtable. +> - Create a firewall rule. Set the action to +> `offload` and use your desired flowtable for `offload-target`. + +Creating a flow table: + +```{cfgcmd} set firewall flowtable \ interface \ + +Specify interfaces to use in the flowtable. +``` + +```{cfgcmd} set firewall flowtable \ description \ +``` + +Provide a description for the flow table. + +```{cfgcmd} set firewall flowtable \ offload \ + +Specify the offload type the flowtable uses: ``hardware`` or +``software``. The default is ``software`` offload. +``` +:::{note} +**Hardware offload**: Make sure your network interface controller +(NIC) supports hardware offloading and that you have the necessary drivers +> installed before enabling this option. +::: + +Creating rules for using flow tables: + +```{cfgcmd} set firewall [ipv4 | ipv6] forward filter rule \<1-999999\> action offload + +Create a firewall rule in the forward chain with the action set to +``offload``. +``` + +```{cfgcmd} set firewall [ipv4 | ipv6] forward filter rule \<1-999999\> offload-target \ + +Create a firewall rule in the forward chain and specify which flowtable +to use. Only applicable if the action is ``offload``. +``` + +## Configuration Example + +Consider the following in this setup: +> - This example uses two interfaces in the flowtables: `eth0` and `eth1`. +> - The example provides a minimal firewall ruleset with filtering rules +> and rules for using flowtable offload capabilities. + +The first packet is evaluated by the firewall path, so a +desired connection should be explicitly accepted. +The same should occur for traffic in reverse order. +In most cases, state policies are +used to accept a connection in the reverse path. + +In the following example only traffic coming from interface `eth0`, +TCP protocol, and destination port 1122 is accepted. +All other traffic to the router is dropped. + +### Commands + +```none +set firewall flowtable FT01 interface 'eth0' +set firewall flowtable FT01 interface 'eth1' +set firewall ipv4 forward filter default-action 'drop' +set firewall ipv4 forward filter rule 10 action 'offload' +set firewall ipv4 forward filter rule 10 offload-target 'FT01' +set firewall ipv4 forward filter rule 10 state 'established' +set firewall ipv4 forward filter rule 10 state 'related' +set firewall ipv4 forward filter rule 20 action 'accept' +set firewall ipv4 forward filter rule 20 state 'established' +set firewall ipv4 forward filter rule 20 state 'related' +set firewall ipv4 forward filter rule 110 action 'accept' +set firewall ipv4 forward filter rule 110 destination address '192.0.2.100' +set firewall ipv4 forward filter rule 110 destination port '1122' +set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0' +set firewall ipv4 forward filter rule 110 protocol 'tcp' +``` + +### Explanation + +Here's what happens for a desired connection: +> 1. A packet arrives on `eth0` with destination address `192.0.2.100`, TCP +> protocol, and destination port 1122. Assume this address is reachable +> through interface `eth1`. +> 2. For this first packet, the connection state is **new**. Neither rule 10 +> nor rule 20 applies. +> 3. Rule 110 matches, so the connection is accepted. +> 4. When the server 192.0.2.100 replies, the connection state becomes +> **established**, and rule 20 accepts the reply. +> 5. The router receives the second packet for this connection. Because the +> connection state is **established**, rule 10 matches and adds a new +> entry in the flowtable FT01 for this connection. +> 6. Subsequent packets skip the traditional path and use the **Fast Path** +> for offloading. + +### Checks + +Check the conntrack table to verify that the system accepted and properly +offloaded connections. + +```none +vyos@FlowTables:~$ show firewall ipv4 forward filter +Ruleset Information + +--------------------------------- +ipv4 Firewall "forward filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------------------------------------------------- +10 offload all 8 468 ct state { established, related } flow add @VYOS_FLOWTABLE_FT01 +20 accept all 8 468 ct state { established, related } accept +110 accept tcp 2 120 ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0" accept +default drop all 7 420 + +vyos@FlowTables:~$ sudo conntrack -L | grep tcp +conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown. +tcp 6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2 +vyos@FlowTables:~$ +``` diff --git a/docs/configuration/firewall/flowtables.rst b/docs/configuration/firewall/flowtables.rst deleted file mode 100644 index f996a59e..00000000 --- a/docs/configuration/firewall/flowtables.rst +++ /dev/null @@ -1,188 +0,0 @@ -:lastproofread: 2026-03-30 - -.. _firewall-flowtables-configuration: - -################################# -Flowtables Firewall Configuration -################################# - -.. include:: /_include/need_improvement.txt - -******** -Overview -******** - -This section provides information on firewall configuration for flowtables. - -.. cfgcmd:: set firewall flowtable ... - -To learn about the general traffic flow in VyOS firewalls, -see :doc:`Firewall `. - -.. code-block:: none - - - set firewall - * flowtable - - custom_flow_table - + ... - - -Flowtables let you define a fastpath through the flowtable datapath. -Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP) -protocols. - -.. figure:: /_static/images/firewall-flowtable-packet-flow.* - -After the first packet successfully traverses the IP forwarding path (black -circles path), you can offload subsequent packets to the flowtable through your -ruleset. You specify when to add a flow to the flowtable during forward -filtering (red circle number 6). - -When a packet finds a matching entry in the flowtable (flowtable hit), the -system transmits it to the output netdevice. This means packets bypass the -classic IP forwarding path and use the **Fast Path** (orange circles path). -As a result, you do not see these packets from any Netfilter hooks after -ingress. If no matching entry exists in the flowtable (flowtable miss), the -packet traverses the classic IP forwarding path. - -.. note:: **Flowtable Reference:** - https://docs.kernel.org/networking/nf_flowtable.html - - -*********************** -Flowtable Configuration -*********************** - -To use flowtables, you need to configure the following: - - * Create a flowtable that includes the interfaces - that are going to be used by the flowtable. - - * Create a firewall rule. Set the action to - ``offload`` and use your desired flowtable for ``offload-target``. - -Creating a flow table: - -.. cfgcmd:: set firewall flowtable interface - - Specify interfaces to use in the flowtable. - -.. cfgcmd:: set firewall flowtable description - -Provide a description for the flow table. - -.. cfgcmd:: set firewall flowtable offload - - - Specify the offload type the flowtable uses: ``hardware`` or - ``software``. The default is ``software`` offload. - -.. note:: **Hardware offload**: Make sure your network interface controller - (NIC) supports hardware offloading and that you have the necessary drivers - installed before enabling this option. - -Creating rules for using flow tables: - -.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999> - action offload - - Create a firewall rule in the forward chain with the action set to - ``offload``. - -.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999> - offload-target - - Create a firewall rule in the forward chain and specify which flowtable - to use. Only applicable if the action is ``offload``. - -********************* -Configuration Example -********************* - -Consider the following in this setup: - - * This example uses two interfaces in the flowtables: ``eth0`` and ``eth1``. - - * The example provides a minimal firewall ruleset with filtering rules - and rules for using flowtable offload capabilities. - -The first packet is evaluated by the firewall path, so a -desired connection should be explicitly accepted. -The same should occur for traffic in reverse order. -In most cases, state policies are -used to accept a connection in the reverse path. - -In the following example only traffic coming from interface ``eth0``, -TCP protocol, and destination port 1122 is accepted. -All other traffic to the router is dropped. - -Commands --------- - -.. code-block:: none - - set firewall flowtable FT01 interface 'eth0' - set firewall flowtable FT01 interface 'eth1' - set firewall ipv4 forward filter default-action 'drop' - set firewall ipv4 forward filter rule 10 action 'offload' - set firewall ipv4 forward filter rule 10 offload-target 'FT01' - set firewall ipv4 forward filter rule 10 state 'established' - set firewall ipv4 forward filter rule 10 state 'related' - set firewall ipv4 forward filter rule 20 action 'accept' - set firewall ipv4 forward filter rule 20 state 'established' - set firewall ipv4 forward filter rule 20 state 'related' - set firewall ipv4 forward filter rule 110 action 'accept' - set firewall ipv4 forward filter rule 110 destination address '192.0.2.100' - set firewall ipv4 forward filter rule 110 destination port '1122' - set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0' - set firewall ipv4 forward filter rule 110 protocol 'tcp' - -Explanation ------------ - -Here's what happens for a desired connection: - - 1. A packet arrives on ``eth0`` with destination address ``192.0.2.100``, TCP - protocol, and destination port 1122. Assume this address is reachable - through interface ``eth1``. - - 2. For this first packet, the connection state is **new**. Neither rule 10 - nor rule 20 applies. - - 3. Rule 110 matches, so the connection is accepted. - - 4. When the server 192.0.2.100 replies, the connection state becomes - **established**, and rule 20 accepts the reply. - - 5. The router receives the second packet for this connection. Because the - connection state is **established**, rule 10 matches and adds a new - entry in the flowtable FT01 for this connection. - - 6. Subsequent packets skip the traditional path and use the **Fast Path** - for offloading. - -Checks ------- - -Check the conntrack table to verify that the system accepted and properly -offloaded connections. - -.. code-block:: none - - vyos@FlowTables:~$ show firewall ipv4 forward filter - Ruleset Information - - --------------------------------- - ipv4 Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------------------------------- - 10 offload all 8 468 ct state { established, related } flow add @VYOS_FLOWTABLE_FT01 - 20 accept all 8 468 ct state { established, related } accept - 110 accept tcp 2 120 ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0" accept - default drop all 7 420 - - vyos@FlowTables:~$ sudo conntrack -L | grep tcp - conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown. - tcp 6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2 - vyos@FlowTables:~$ diff --git a/docs/configuration/firewall/global-options.md b/docs/configuration/firewall/global-options.md new file mode 100644 index 00000000..0f6d91ac --- /dev/null +++ b/docs/configuration/firewall/global-options.md @@ -0,0 +1,186 @@ +--- +lastproofread: '2026-03-30' +--- + +(firewall-global-options-configuration)= + +# Global Options Firewall Configuration + +## Overview + +Some firewall settings are global and affect the entire system. This section +provides information about these global options that you can configure using +the VyOS CLI. + +Configuration commands covered in this section: + +```{cfgcmd} set firewall global-options ... +``` + +## Configuration + +```{cfgcmd} set firewall global-options all-ping [enable | disable] + +By default, when VyOS receives an ICMP echo request packet destined for +itself, it answers with an ICMP echo reply, unless your firewall prevents +it. + +You can set firewall rules to accept, drop, or reject ICMP in, out, or +local traffic. You can also use the **firewall global-options all-ping** +command. This command affects only LOCAL traffic (packets destined for your +VyOS system), not IN or OUT traffic. + +:::{note} +**firewall global-options all-ping** affects only LOCAL traffic +and always behaves in the most restrictive way +::: +:::{code-block} none +set firewall global-options all-ping enable +::: +When you set this command, VyOS answers every ICMP echo request addressed +to itself, but that response occurs only if no other rule drops or rejects +local echo requests. In case of conflict, VyOS does not answer ICMP echo +requests. + +:::{code-block} none +set firewall global-options all-ping disable +::: +When you set this command, VyOS answers no ICMP echo requests addressed to +itself, regardless of where they come from or what specific rules accept +them. +``` + +```{cfgcmd} set firewall global-options apply-to-bridged-traffic [ipv4 | ipv6] + +Apply IPv4 or IPv6 firewall rules to bridged traffic. +``` + +```{cfgcmd} set firewall global-options broadcast-ping [enable | disable] + +Enable or disable the response to ICMP broadcast messages. The system +alters the following parameter: +* ``net.ipv4.icmp_echo_ignore_broadcasts`` +``` + +```{cfgcmd} set firewall global-options ip-src-route [enable | disable] +``` + +```{cfgcmd} set firewall global-options ipv6-src-route [enable | disable] + +Set whether VyOS accepts packets with a source route option. +The following sysctl parameters will be changed: +* ``net.ipv4.conf.all.accept_source_route`` +* ``net.ipv6.conf.all.accept_source_route`` +``` + +```{cfgcmd} set firewall global-options receive-redirects [enable | disable] +``` + +```{cfgcmd} set firewall global-options ipv6-receive-redirects [enable | disable] + +Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages. +The following sysctl parameters will be changed: +* ``net.ipv4.conf.all.accept_redirects`` +* ``net.ipv6.conf.all.accept_redirects`` +``` + +```{cfgcmd} set firewall global-options send-redirects [enable | disable] + +Allow VyOS to send ICMPv4 redirect messages. +The following sysctl parameter will be changed: +* ``net.ipv4.conf.all.send_redirects`` +``` + +```{cfgcmd} set firewall global-options log-martians [enable | disable] + +Allow VyOS to log martian IPv4 packets. +The following sysctl parameter will be changed: +* ``net.ipv4.conf.all.log_martians`` +``` + +```{cfgcmd} set firewall global-options source-validation [strict | loose | disable] + +Set the IPv4 source validation mode. +The following sysctl parameter will be changed: +* ``net.ipv4.conf.all.rp_filter`` +``` + +```{cfgcmd} set firewall global-options syn-cookies [enable | disable] + +Allow VyOS to use IPv4 TCP SYN Cookies. +The following sysctl parameter will be changed: +* ``net.ipv4.tcp_syncookies`` +``` + +```{cfgcmd} set firewall global-options twa-hazards-protection [enable | disable] + +Enable or disable VyOS {rfc}`1337` conformance. +The following sysctl parameter will be changed: +* ``net.ipv4.tcp_rfc1337`` +``` + +```{cfgcmd} set firewall global-options state-policy established action [accept | drop | reject] +``` + +```{cfgcmd} set firewall global-options state-policy established log +``` + +```{cfgcmd} set firewall global-options state-policy established log-level [emerg | alert | crit | err | warn | notice | info | debug] + +Set the global setting for an established connection. +``` + +```{cfgcmd} set firewall global-options state-policy invalid action [accept | drop | reject] +``` + +```{cfgcmd} set firewall global-options state-policy invalid log +``` + +```{cfgcmd} set firewall global-options state-policy invalid log-level [emerg | alert | crit | err | warn | notice | info | debug] + +Set the global setting for invalid packets. +``` + +```{cfgcmd} set firewall global-options state-policy related action [accept | drop | reject] +``` + +```{cfgcmd} set firewall global-options state-policy related log +``` + +```{cfgcmd} set firewall global-options state-policy related log-level [emerg | alert | crit | err | warn | notice | info | debug] + +Set the global setting for related connections. +``` + +VyOS supports setting timeouts for connections by connection type. You can +set timeout values for generic connections, ICMP connections, UDP +connections, or TCP connections in various states. + +```{eval-rst} +.. cfgcmd:: set firewall global-options timeout icmp <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout other <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp close <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp close-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp established <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp fin-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp last-ack <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp syn-recv <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp syn-sent <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp time-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout udp other <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout udp stream <1-21474836> + :defaultvalue: + + Set the timeout in seconds for a protocol or state. +``` \ No newline at end of file diff --git a/docs/configuration/firewall/global-options.rst b/docs/configuration/firewall/global-options.rst deleted file mode 100644 index 8eec5c3f..00000000 --- a/docs/configuration/firewall/global-options.rst +++ /dev/null @@ -1,182 +0,0 @@ -:lastproofread: 2026-03-30 - -.. _firewall-global-options-configuration: - -##################################### -Global Options Firewall Configuration -##################################### - -******** -Overview -******** - -Some firewall settings are global and affect the entire system. This section -provides information about these global options that you can configure using -the VyOS CLI. - -Configuration commands covered in this section: - -.. cfgcmd:: set firewall global-options ... - -************* -Configuration -************* - -.. cfgcmd:: set firewall global-options all-ping [enable | disable] - - By default, when VyOS receives an ICMP echo request packet destined for - itself, it answers with an ICMP echo reply, unless your firewall prevents - it. - - You can set firewall rules to accept, drop, or reject ICMP in, out, or - local traffic. You can also use the **firewall global-options all-ping** - command. This command affects only LOCAL traffic (packets destined for your - VyOS system), not IN or OUT traffic. - - .. note:: **firewall global-options all-ping** affects only LOCAL traffic - and always behaves in the most restrictive way - - .. code-block:: none - - set firewall global-options all-ping enable - - When you set this command, VyOS answers every ICMP echo request addressed - to itself, but that response occurs only if no other rule drops or rejects - local echo requests. In case of conflict, VyOS does not answer ICMP echo - requests. - - .. code-block:: none - - set firewall global-options all-ping disable - - When you set this command, VyOS answers no ICMP echo requests addressed to - itself, regardless of where they come from or what specific rules accept - them. - -.. cfgcmd:: set firewall global-options apply-to-bridged-traffic [ipv4 | ipv6] - - Apply IPv4 or IPv6 firewall rules to bridged traffic. - -.. cfgcmd:: set firewall global-options broadcast-ping [enable | disable] - - Enable or disable the response to ICMP broadcast messages. The system - alters the following parameter: - - * ``net.ipv4.icmp_echo_ignore_broadcasts`` - -.. cfgcmd:: set firewall global-options ip-src-route [enable | disable] -.. cfgcmd:: set firewall global-options ipv6-src-route [enable | disable] - - Set whether VyOS accepts packets with a source route option. - The following sysctl parameters will be changed: - - * ``net.ipv4.conf.all.accept_source_route`` - * ``net.ipv6.conf.all.accept_source_route`` - -.. cfgcmd:: set firewall global-options receive-redirects [enable | disable] -.. cfgcmd:: set firewall global-options ipv6-receive-redirects - [enable | disable] - - Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages. - The following sysctl parameters will be changed: - - * ``net.ipv4.conf.all.accept_redirects`` - * ``net.ipv6.conf.all.accept_redirects`` - -.. cfgcmd:: set firewall global-options send-redirects [enable | disable] - - Allow VyOS to send ICMPv4 redirect messages. - The following sysctl parameter will be changed: - - * ``net.ipv4.conf.all.send_redirects`` - -.. cfgcmd:: set firewall global-options log-martians [enable | disable] - - Allow VyOS to log martian IPv4 packets. - The following sysctl parameter will be changed: - - * ``net.ipv4.conf.all.log_martians`` - -.. cfgcmd:: set firewall global-options source-validation - [strict | loose | disable] - - Set the IPv4 source validation mode. - The following sysctl parameter will be changed: - - * ``net.ipv4.conf.all.rp_filter`` - -.. cfgcmd:: set firewall global-options syn-cookies [enable | disable] - - Allow VyOS to use IPv4 TCP SYN Cookies. - The following sysctl parameter will be changed: - - * ``net.ipv4.tcp_syncookies`` - -.. cfgcmd:: set firewall global-options twa-hazards-protection - [enable | disable] - - Enable or disable VyOS :rfc:`1337` conformance. - The following sysctl parameter will be changed: - - * ``net.ipv4.tcp_rfc1337`` - -.. cfgcmd:: set firewall global-options state-policy established action - [accept | drop | reject] - -.. cfgcmd:: set firewall global-options state-policy established log - -.. cfgcmd:: set firewall global-options state-policy established log-level - [emerg | alert | crit | err | warn | notice | info | debug] - - Set the global setting for an established connection. - -.. cfgcmd:: set firewall global-options state-policy invalid action - [accept | drop | reject] - -.. cfgcmd:: set firewall global-options state-policy invalid log - -.. cfgcmd:: set firewall global-options state-policy invalid log-level - [emerg | alert | crit | err | warn | notice | info | debug] - - Set the global setting for invalid packets. - -.. cfgcmd:: set firewall global-options state-policy related action - [accept | drop | reject] - -.. cfgcmd:: set firewall global-options state-policy related log - -.. cfgcmd:: set firewall global-options state-policy related log-level - [emerg | alert | crit | err | warn | notice | info | debug] - - Set the global setting for related connections. - -VyOS supports setting timeouts for connections by connection type. You can -set timeout values for generic connections, ICMP connections, UDP -connections, or TCP connections in various states. - -.. cfgcmd:: set firewall global-options timeout icmp <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout other <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp close <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp close-wait <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp established <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp fin-wait <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp last-ack <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp syn-recv <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp syn-sent <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp time-wait <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout udp other <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout udp stream <1-21474836> - :defaultvalue: - - Set the timeout in seconds for a protocol or state. \ No newline at end of file diff --git a/docs/configuration/firewall/groups.md b/docs/configuration/firewall/groups.md new file mode 100644 index 00000000..817f610e --- /dev/null +++ b/docs/configuration/firewall/groups.md @@ -0,0 +1,477 @@ +--- +lastproofread: '2026-03-30' +--- + +(firewall-groups-configuration)= + +# Firewall groups + +## Configuration + +Firewall groups represent collections of IP addresses, networks, ports, +MAC addresses, domains, or interfaces. You can reference a group in firewall, +NAT, and policy route rules as either a source or destination matcher, and/or +as inbound or outbound in the case of interface groups. + +### Address Groups + +An **address group** contains a single IP address or IP address range. + +```{cfgcmd} set firewall group address-group \ address [address | address range] + +``` +```{cfgcmd} set firewall group ipv6-address-group \ address \ + +Define an IPv4 or IPv6 address group. + +:::{code-block} none +set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1 +set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8 +set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1 +::: +``` + +```{cfgcmd} set firewall group address-group \ description \ +``` + +```{cfgcmd} set firewall group ipv6-address-group \ description \ + +Provide an IPv4 or IPv6 address group description. +``` + +### Remote Groups + +A **remote-group** uses a URL that hosts a newline-delimited list of IPv4 +and/or IPv6 addresses, CIDRs, and ranges. VyOS pulls this list periodically +according to the frequency you define in the firewall **resolver-interval** +and loads matching entries into the group for use in rules. The list is cached +in persistent storage, so rules continue to function if updates fail. + +```{cfgcmd} set firewall group remote-group \ url \ + +Specify a remote list of IPv4 and/or IPv6 addresses, ranges, and CIDRs +to fetch. +``` + +```{cfgcmd} set firewall group remote-group \ description \ + +Set a description for a remote group. +``` + +The remote list format is flexible. VyOS attempts to parse the first word of +each line as an entry and skips lines it cannot match. Lines that begin with +an alphanumeric character but do not match valid IPv4 or IPv6 addresses, +ranges, or CIDRs are logged to the system log. The following examples show +acceptable formats that VyOS parses correctly: + +```none +127.0.0.1 +127.0.0.0/24 +127.0.0.1-127.0.0.254 +2001:db8::1 +2001:db8:cafe::/48 +2001:db8:cafe::1-2001:db8:cafe::ffff +``` + +### Network Groups + +**Network groups** accept IP networks in CIDR notation. You can add specific +IP addresses as a 32-bit prefix. If you need to add a mix of addresses and +networks, use a network group. + +```{cfgcmd} set firewall group network-group \ network \ +``` + +```{cfgcmd} set firewall group ipv6-network-group \ network \ + +Define an IPv4 or IPv6 network group. + +:::{code-block} none +set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24 +set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24 +set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64 +::: +``` + +```{cfgcmd} set firewall group network-group \ description \ +``` + +```{cfgcmd} set firewall group ipv6-network-group \ description \ + +Provide an IPv4 or IPv6 network group description. +``` + +### Interface Groups + +An **interface group** represents a collection of interfaces. + +```{cfgcmd} set firewall group interface-group \ interface \ + +Define an interface group. +Wildcard ``*`` is supported. For example: ``eth3*``. +Prepend the character ``!`` to invert the criteria. For example: ``!eth2``. +``` + +```none +set firewall group interface-group LAN interface bond1001 +set firewall group interface-group LAN interface eth3* +``` + +```{cfgcmd} set firewall group interface-group \ description \ + +Provide an interface group description. +``` + +### Port Groups + +A **port group** represents only port numbers, not the protocol. You can +reference port groups for either TCP or UDP. Create TCP and UDP groups +separately to avoid accidentally filtering unnecessary ports. Specify port +ranges by using `-`. + +```{cfgcmd} set firewall group port-group \ port [portname | portnumber | startport-endport] + +Define a port group. A port name can be any name defined in +/etc/services. For example, ``http``. + +:::{code-block} none +set firewall group port-group PORT-TCP-SERVER1 port http +set firewall group port-group PORT-TCP-SERVER1 port 443 +set firewall group port-group PORT-TCP-SERVER1 port 5000-5010 +::: +``` + +```{cfgcmd} set firewall group port-group \ description \ + +Provide a port group description. +``` + +### MAC Groups + +A **mac group** represents a collection of mac addresses. + +```{cfgcmd} set firewall group mac-group \ mac-address \ + +Define a mac group. +``` + +```none +set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f +set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81 +``` + +```{cfgcmd} set firewall group mac-group \ description \ + +Provide a MAC group description. +``` + +### Domain Groups + +A **domain group** represents a collection of domains. + +```{cfgcmd} set firewall group domain-group \ address \ + +Define a domain group. +``` + +```none +set firewall group domain-group DOM address example.com +``` + +```{cfgcmd} set firewall group domain-group \ description \ + +Provide a domain group description. +``` + +### Dynamic Groups + +Firewall dynamic groups differ from other groups because you can use them as +source/destination in firewall rules, and members are not defined statically +in VyOS configuration. Instead, firewall rules dynamically add members to +these groups. + +#### Defining Dynamic Address Groups + +Dynamic address groups support both IPv4 and IPv6 families. Use these +commands to define dynamic IPv4 and IPv6 address groups: + +```{cfgcmd} set firewall group dynamic-group address-group \ +``` + +```{cfgcmd} set firewall group dynamic-group ipv6-address-group \ +``` + +Add description to firewall groups: + +```{cfgcmd} set firewall group dynamic-group address-group \ description \ +``` + +```{cfgcmd} set firewall group dynamic-group ipv6-address-group \ description \ +``` + +#### Adding elements to Dynamic Firewall Groups + +After you define dynamic firewall groups, use them in firewall rules to +dynamically add elements to them. + +Commands used for this task are: +- Add destination IP address of the connection to a dynamic address group: + +```{cfgcmd} set firewall ipv4 [forward | input | output] filter rule \<1-999999\> add-address-to-group destination-address address-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> add-address-to-group destination-address address-group \ +``` + +```{cfgcmd} set firewall ipv6 [forward | input | output] filter rule \<1-999999\> add-address-to-group destination-address address-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> add-address-to-group destination-address address-group \ +``` + +- Add source IP address of the connection to a dynamic address group: + +```{cfgcmd} set firewall ipv4 [forward | input | output] filter rule \<1-999999\> add-address-to-group source-address address-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> add-address-to-group source-address address-group \ +``` + +```{cfgcmd} set firewall ipv6 [forward | input | output] filter rule \<1-999999\> add-address-to-group source-address address-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> add-address-to-group source-address address-group \ +``` + +You can define specific timeouts per rule. When a rule matches, the source or +destination address is added to the group, and the element remains in the group +until the timeout expires. If you do not define a timeout, the element remains +in the group until the next reboot or until you commit firewall configuration +changes. + +```{cfgcmd} set firewall ipv4 [forward | input | output] filter rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ +``` + +```{cfgcmd} set firewall ipv6 [forward | input | output] filter rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ +``` + +Timeout can be defined using seconds, minutes, hours or days: + +```none +set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout +Possible completions: +s Timeout value in seconds +m Timeout value in minutes +h Timeout value in hours +d Timeout value in days +``` + +#### Using Dynamic Firewall Groups + +Like other firewall groups, you can use dynamic firewall groups in firewall +rules as matching options. For example: + +```none +set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO +set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR +``` + +## Examples + +### General example + +After you create firewall groups, you can reference them in firewall, NAT, +NAT66, and/or policy-route rules. The following example creates multiple +groups: + +```{eval-rst} + .. code-block:: none + + set firewall group address-group SERVERS address 198.51.100.101 + set firewall group address-group SERVERS address 198.51.100.102 + set firewall group network-group TRUSTEDv4 network 192.0.2.0/30 + set firewall group network-group TRUSTEDv4 network 203.0.113.128/25 + set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64 + set firewall group interface-group LAN interface eth2.2001 + set firewall group interface-group LAN interface bon0 + set firewall group port-group PORT-SERVERS port http + set firewall group port-group PORT-SERVERS port 443 + set firewall group port-group PORT-SERVERS port 5000-5010 +``` + +And next, some configuration example where groups are used: + +```{eval-rst} + .. code-block:: none + + set firewall ipv4 output filter rule 10 action accept + set firewall ipv4 output filter rule 10 outbound-interface group !LAN + set firewall ipv4 forward filter rule 20 action accept + set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4 + set firewall ipv6 input filter rule 10 action accept + set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6 + set nat destination rule 101 inbound-interface group LAN + set nat destination rule 101 destination group address-group SERVERS + set nat destination rule 101 protocol tcp + set nat destination rule 101 destination group port-group PORT-SERVERS + set nat destination rule 101 translation address 203.0.113.250 + set policy route PBR rule 201 destination group port-group PORT-SERVERS + set policy route PBR rule 201 protocol tcp + set policy route PBR rule 201 set table 15 +``` + +### Port knocking example + +You can use dynamic firewall groups with port knocking to secure access to +the router or any other device. The following example shows a 4-step port +knocking configuration: + +```{eval-rst} + .. code-block:: none + + set firewall global-options state-policy established action 'accept' + set firewall global-options state-policy invalid action 'drop' + set firewall global-options state-policy related action 'accept' + set firewall group dynamic-group address-group ALLOWED + set firewall group dynamic-group address-group PN_01 + set firewall group dynamic-group address-group PN_02 + set firewall ipv4 input filter default-action 'drop' + set firewall ipv4 input filter rule 5 action 'accept' + set firewall ipv4 input filter rule 5 protocol 'icmp' + set firewall ipv4 input filter rule 10 action 'drop' + set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01' + set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m' + set firewall ipv4 input filter rule 10 description 'Port_nock 01' + set firewall ipv4 input filter rule 10 destination port '9990' + set firewall ipv4 input filter rule 10 protocol 'tcp' + set firewall ipv4 input filter rule 20 action 'drop' + set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02' + set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m' + set firewall ipv4 input filter rule 20 description 'Port_nock 02' + set firewall ipv4 input filter rule 20 destination port '9991' + set firewall ipv4 input filter rule 20 protocol 'tcp' + set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01' + set firewall ipv4 input filter rule 30 action 'drop' + set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED' + set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h' + set firewall ipv4 input filter rule 30 description 'Port_nock 03' + set firewall ipv4 input filter rule 30 destination port '9992' + set firewall ipv4 input filter rule 30 protocol 'tcp' + set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02' + set firewall ipv4 input filter rule 99 action 'accept' + set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh' + set firewall ipv4 input filter rule 99 destination port '22' + set firewall ipv4 input filter rule 99 protocol 'tcp' + set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED' +``` + +Before testing, we can check the members of firewall groups: + +```none +vyos@vyos# run show firewall group +Firewall Groups + +Name Type References Members Timeout Expires +------- ---------------------- -------------------- ------------- --------- --------- +ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D +PN_01 address_group(dynamic) ipv4-input-filter-10 N/D N/D N/D +PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D +[edit] +vyos@vyos# +``` + +With this configuration, to gain SSH access to the router, the user must: + +1. Create a new TCP connection to destination port 9990. A new entry is added + to dynamic firewall group `PN_01`. + + ```none + vyos@vyos# run show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------- ---------------------- -------------------- ------------- --------- --------- + ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D + PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 119 + PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D + [edit] + vyos@vyos# + ``` + +2. Create a new TCP connection to destination port 9991. A new entry is added + to dynamic firewall group `PN_02`. + + ```none + vyos@vyos# run show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------- ---------------------- -------------------- ------------- --------- --------- + ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D + PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 106 + PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 179 + [edit] + vyos@vyos# + ``` + +3. Create a new TCP connection to destination port 9992. A new entry is added + to dynamic firewall group `ALLOWED`. + + ```none + vyos@vyos# run show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------- ---------------------- -------------------- ------------- --------- --------- + ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.89.31 7200 7199 + PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 89 + PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 170 + [edit] + vyos@vyos# + ``` + +4. Now you can connect via SSH to the router (assuming SSH is + configured). + +## Operation-mode + +```{opcmd} show firewall group +``` + +```{opcmd} show firewall group \ + +Display an overview of defined groups, including the firewall group name, +type, references (where the group is used), members, timeout, and +expiration (the last two only apply to dynamic firewall groups). +``` + +Here is an example of such command: + +```none +vyos@vyos:~$ show firewall group +Firewall Groups + +Name Type References Members Timeout Expires +------------ ---------------------- ---------------------- ---------------- --------- --------- +SERVERS address_group nat-destination-101 198.51.100.101 + 198.51.100.102 +ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.77.39 7200 7174 +PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.0.245 120 112 + 192.168.77.39 120 85 +PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.77.39 180 151 +LAN interface_group ipv4-output-filter-10 bon0 + nat-destination-101 eth2.2001 +TRUSTEDv6 ipv6_network_group ipv6-input-filter-10 2001:db8::/64 +TRUSTEDv4 network_group ipv4-forward-filter-20 192.0.2.0/30 + 203.0.113.128/25 +PORT-SERVERS port_group route-PBR-201 443 + route-PBR-201 5000-5010 + nat-destination-101 http +vyos@vyos:~$ +``` diff --git a/docs/configuration/firewall/groups.rst b/docs/configuration/firewall/groups.rst deleted file mode 100644 index 9d29866e..00000000 --- a/docs/configuration/firewall/groups.rst +++ /dev/null @@ -1,457 +0,0 @@ -:lastproofread: 2026-03-30 - -.. _firewall-groups-configuration: - -############### -Firewall groups -############### - -************* -Configuration -************* - -Firewall groups represent collections of IP addresses, networks, ports, -MAC addresses, domains, or interfaces. You can reference a group in firewall, -NAT, and policy route rules as either a source or destination matcher, and/or -as inbound or outbound in the case of interface groups. - -Address Groups -============== - -An **address group** contains a single IP address or IP address range. - -.. cfgcmd:: set firewall group address-group address [address | - address range] -.. cfgcmd:: set firewall group ipv6-address-group address
- - Define an IPv4 or IPv6 address group. - - .. code-block:: none - - set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1 - set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8 - set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1 - -.. cfgcmd:: set firewall group address-group description -.. cfgcmd:: set firewall group ipv6-address-group description - - Provide an IPv4 or IPv6 address group description. - -Remote Groups -============== - -A **remote-group** uses a URL that hosts a newline-delimited list of IPv4 -and/or IPv6 addresses, CIDRs, and ranges. VyOS pulls this list periodically -according to the frequency you define in the firewall **resolver-interval** -and loads matching entries into the group for use in rules. The list is cached -in persistent storage, so rules continue to function if updates fail. - -.. cfgcmd:: set firewall group remote-group url - - Specify a remote list of IPv4 and/or IPv6 addresses, ranges, and CIDRs - to fetch. - -.. cfgcmd:: set firewall group remote-group description - - Set a description for a remote group. - -The remote list format is flexible. VyOS attempts to parse the first word of -each line as an entry and skips lines it cannot match. Lines that begin with -an alphanumeric character but do not match valid IPv4 or IPv6 addresses, -ranges, or CIDRs are logged to the system log. The following examples show -acceptable formats that VyOS parses correctly: - -.. code-block:: none - - 127.0.0.1 - 127.0.0.0/24 - 127.0.0.1-127.0.0.254 - 2001:db8::1 - 2001:db8:cafe::/48 - 2001:db8:cafe::1-2001:db8:cafe::ffff - -Network Groups -============== - -**Network groups** accept IP networks in CIDR notation. You can add specific -IP addresses as a 32-bit prefix. If you need to add a mix of addresses and -networks, use a network group. - -.. cfgcmd:: set firewall group network-group network -.. cfgcmd:: set firewall group ipv6-network-group network - - Define an IPv4 or IPv6 network group. - - .. code-block:: none - - set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24 - set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24 - set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64 - -.. cfgcmd:: set firewall group network-group description -.. cfgcmd:: set firewall group ipv6-network-group description - - Provide an IPv4 or IPv6 network group description. - -Interface Groups -================ - -An **interface group** represents a collection of interfaces. - -.. cfgcmd:: set firewall group interface-group interface - - Define an interface group. - Wildcard ``*`` is supported. For example: ``eth3*``. - Prepend the character ``!`` to invert the criteria. For example: ``!eth2``. - -.. code-block:: none - - set firewall group interface-group LAN interface bond1001 - set firewall group interface-group LAN interface eth3* - -.. cfgcmd:: set firewall group interface-group description - - Provide an interface group description. - -Port Groups -=========== - -A **port group** represents only port numbers, not the protocol. You can -reference port groups for either TCP or UDP. Create TCP and UDP groups -separately to avoid accidentally filtering unnecessary ports. Specify port -ranges by using `-`. - -.. cfgcmd:: set firewall group port-group port - [portname | portnumber | startport-endport] - - Define a port group. A port name can be any name defined in - /etc/services. For example, ``http``. - - .. code-block:: none - - set firewall group port-group PORT-TCP-SERVER1 port http - set firewall group port-group PORT-TCP-SERVER1 port 443 - set firewall group port-group PORT-TCP-SERVER1 port 5000-5010 - -.. cfgcmd:: set firewall group port-group description - - Provide a port group description. - -MAC Groups -========== - -A **mac group** represents a collection of mac addresses. - -.. cfgcmd:: set firewall group mac-group mac-address - - Define a mac group. - -.. code-block:: none - - set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f - set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81 - -.. cfgcmd:: set firewall group mac-group description - - Provide a MAC group description. - -Domain Groups -============= - -A **domain group** represents a collection of domains. - -.. cfgcmd:: set firewall group domain-group address - - Define a domain group. - -.. code-block:: none - - set firewall group domain-group DOM address example.com - -.. cfgcmd:: set firewall group domain-group description - - Provide a domain group description. - -Dynamic Groups -============== - -Firewall dynamic groups differ from other groups because you can use them as -source/destination in firewall rules, and members are not defined statically -in VyOS configuration. Instead, firewall rules dynamically add members to -these groups. - -Defining Dynamic Address Groups -------------------------------- - -Dynamic address groups support both IPv4 and IPv6 families. Use these -commands to define dynamic IPv4 and IPv6 address groups: - -.. cfgcmd:: set firewall group dynamic-group address-group -.. cfgcmd:: set firewall group dynamic-group ipv6-address-group - -Add description to firewall groups: - -.. cfgcmd:: set firewall group dynamic-group address-group - description -.. cfgcmd:: set firewall group dynamic-group ipv6-address-group - description - -Adding elements to Dynamic Firewall Groups ------------------------------------------- - -After you define dynamic firewall groups, use them in firewall rules to -dynamically add elements to them. - -Commands used for this task are: - -* Add destination IP address of the connection to a dynamic address group: - -.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule - <1-999999> add-address-to-group destination-address address-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group - destination-address address-group -.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule - <1-999999> add-address-to-group destination-address address-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group - destination-address address-group - -* Add source IP address of the connection to a dynamic address group: - -.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule - <1-999999> add-address-to-group source-address address-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group - source-address address-group -.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule - <1-999999> add-address-to-group source-address address-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group - source-address address-group - -You can define specific timeouts per rule. When a rule matches, the source or -destination address is added to the group, and the element remains in the group -until the timeout expires. If you do not define a timeout, the element remains -in the group until the next reboot or until you commit firewall configuration -changes. - -.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule - <1-999999> add-address-to-group [destination-address | source-address] - timeout -.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group - [destination-address | source-address] timeout -.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule - <1-999999> add-address-to-group [destination-address | source-address] - timeout -.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group - [destination-address | source-address] timeout - -Timeout can be defined using seconds, minutes, hours or days: - -.. code-block:: none - - set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout - Possible completions: - s Timeout value in seconds - m Timeout value in minutes - h Timeout value in hours - d Timeout value in days - -Using Dynamic Firewall Groups ------------------------------ - -Like other firewall groups, you can use dynamic firewall groups in firewall -rules as matching options. For example: - -.. code-block:: none - - set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO - set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR - -******** -Examples -******** - -General example -=============== - -After you create firewall groups, you can reference them in firewall, NAT, -NAT66, and/or policy-route rules. The following example creates multiple -groups: - - .. code-block:: none - - set firewall group address-group SERVERS address 198.51.100.101 - set firewall group address-group SERVERS address 198.51.100.102 - set firewall group network-group TRUSTEDv4 network 192.0.2.0/30 - set firewall group network-group TRUSTEDv4 network 203.0.113.128/25 - set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64 - set firewall group interface-group LAN interface eth2.2001 - set firewall group interface-group LAN interface bon0 - set firewall group port-group PORT-SERVERS port http - set firewall group port-group PORT-SERVERS port 443 - set firewall group port-group PORT-SERVERS port 5000-5010 - -And next, some configuration example where groups are used: - - .. code-block:: none - - set firewall ipv4 output filter rule 10 action accept - set firewall ipv4 output filter rule 10 outbound-interface group !LAN - set firewall ipv4 forward filter rule 20 action accept - set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4 - set firewall ipv6 input filter rule 10 action accept - set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6 - set nat destination rule 101 inbound-interface group LAN - set nat destination rule 101 destination group address-group SERVERS - set nat destination rule 101 protocol tcp - set nat destination rule 101 destination group port-group PORT-SERVERS - set nat destination rule 101 translation address 203.0.113.250 - set policy route PBR rule 201 destination group port-group PORT-SERVERS - set policy route PBR rule 201 protocol tcp - set policy route PBR rule 201 set table 15 - -Port knocking example -===================== - -You can use dynamic firewall groups with port knocking to secure access to -the router or any other device. The following example shows a 4-step port -knocking configuration: - - .. code-block:: none - - set firewall global-options state-policy established action 'accept' - set firewall global-options state-policy invalid action 'drop' - set firewall global-options state-policy related action 'accept' - set firewall group dynamic-group address-group ALLOWED - set firewall group dynamic-group address-group PN_01 - set firewall group dynamic-group address-group PN_02 - set firewall ipv4 input filter default-action 'drop' - set firewall ipv4 input filter rule 5 action 'accept' - set firewall ipv4 input filter rule 5 protocol 'icmp' - set firewall ipv4 input filter rule 10 action 'drop' - set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01' - set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m' - set firewall ipv4 input filter rule 10 description 'Port_nock 01' - set firewall ipv4 input filter rule 10 destination port '9990' - set firewall ipv4 input filter rule 10 protocol 'tcp' - set firewall ipv4 input filter rule 20 action 'drop' - set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02' - set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m' - set firewall ipv4 input filter rule 20 description 'Port_nock 02' - set firewall ipv4 input filter rule 20 destination port '9991' - set firewall ipv4 input filter rule 20 protocol 'tcp' - set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01' - set firewall ipv4 input filter rule 30 action 'drop' - set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED' - set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h' - set firewall ipv4 input filter rule 30 description 'Port_nock 03' - set firewall ipv4 input filter rule 30 destination port '9992' - set firewall ipv4 input filter rule 30 protocol 'tcp' - set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02' - set firewall ipv4 input filter rule 99 action 'accept' - set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh' - set firewall ipv4 input filter rule 99 destination port '22' - set firewall ipv4 input filter rule 99 protocol 'tcp' - set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED' - -Before testing, we can check the members of firewall groups: - - .. code-block:: none - - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D - PN_01 address_group(dynamic) ipv4-input-filter-10 N/D N/D N/D - PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D - [edit] - vyos@vyos# - -With this configuration, to gain SSH access to the router, the user must: - -1. Create a new TCP connection to destination port 9990. A new entry is added - to dynamic firewall group ``PN_01``. - - .. code-block:: none - - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 119 - PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D - [edit] - vyos@vyos# - -2. Create a new TCP connection to destination port 9991. A new entry is added - to dynamic firewall group ``PN_02``. - - .. code-block:: none - - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 106 - PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 179 - [edit] - vyos@vyos# - -3. Create a new TCP connection to destination port 9992. A new entry is added - to dynamic firewall group ``ALLOWED``. - - .. code-block:: none - - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.89.31 7200 7199 - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 89 - PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 170 - [edit] - vyos@vyos# - -4. Now you can connect via SSH to the router (assuming SSH is - configured). - -************** -Operation-mode -************** - -.. opcmd:: show firewall group -.. opcmd:: show firewall group - - Display an overview of defined groups, including the firewall group name, - type, references (where the group is used), members, timeout, and - expiration (the last two only apply to dynamic firewall groups). - -Here is an example of such command: - - .. code-block:: none - - vyos@vyos:~$ show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------------ ---------------------- ---------------------- ---------------- --------- --------- - SERVERS address_group nat-destination-101 198.51.100.101 - 198.51.100.102 - ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.77.39 7200 7174 - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.0.245 120 112 - 192.168.77.39 120 85 - PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.77.39 180 151 - LAN interface_group ipv4-output-filter-10 bon0 - nat-destination-101 eth2.2001 - TRUSTEDv6 ipv6_network_group ipv6-input-filter-10 2001:db8::/64 - TRUSTEDv4 network_group ipv4-forward-filter-20 192.0.2.0/30 - 203.0.113.128/25 - PORT-SERVERS port_group route-PBR-201 443 - route-PBR-201 5000-5010 - nat-destination-101 http - vyos@vyos:~$ diff --git a/docs/configuration/firewall/index.md b/docs/configuration/firewall/index.md new file mode 100644 index 00000000..9108a800 --- /dev/null +++ b/docs/configuration/firewall/index.md @@ -0,0 +1,278 @@ +--- +lastproofread: '2026-03-30' +--- + +# Firewall + +:::{warning} +Due to a boot-time race condition, all interfaces initialize +before the firewall. This temporarily leaves the system open to all traffic +and poses a security risk. +::: + +VyOS uses Netfilter. The Netfilter +project developed `iptables` and its successor `nftables` for the Linux +kernel to process packet data flows directly. This extends the concept of +zone-based security to let you manipulate data at multiple stages after the +network interface and driver accept it, and before sending it to its +destination (for example, a web server or another device). + +The following is a simplified traffic flow diagram based on Netfilter +packet flow. +This diagram provides an overview of how packets are processed and the +possible paths traffic can take. + +:::{figure} /_static/images/firewall-gral-packet-flow.webp +::: + +The main points regarding packet flow and terminology in VyOS firewall +are: + +- **Bridge Port?**: Choose the appropriate path based on whether the + interface where the packet was received is part of a bridge. + +If the interface where the packet was received is not part of a bridge, the +packet is processed at the **IP Layer**: + +```{eval-rst} + * **Prerouting**: The router processes all packets in this stage, + regardless of the destination. You can perform several actions in + this stage, and these actions are also defined in different parts of the + VyOS configuration. Order is important. The relevant configuration that + applies in this stage includes: + + * **Firewall prerouting**: Rules you define under ``set firewall + [ipv4 | ipv6] prerouting raw...``. The system processes all rules in + this section before the connection tracking subsystem. + + * **Conntrack Ignore**: Rules you define under ``set system conntrack + ignore [ipv4 | ipv6] ...``. You can configure this section with + ``firewall [ipv4 | ipv6] prerouting ...``. For compatibility reasons, + this feature is supported, but will be deprecated in the future. + + * **Policy Route**: Rules you define under ``set policy [route | + route6] ...``. + + * **Destination NAT**: Rules you define under ``set [nat | nat66] + destination...``. + + * **Destination is the router?**: Choose the appropriate path based on the + destination IP address. Transit traffic continues to **forward**, while + traffic destined for the router continues to **input**. + + * **Input**: The stage where you filter and control traffic destined for + the router itself. This is where you enforce all rules for securing the + router. This includes IPv4 and IPv6 filtering rules, defined in: + + * ``set firewall ipv4 input filter ...``. + + * ``set firewall ipv6 input filter ...``. + + * **Forward**: The stage where you filter and control transit traffic. + This includes IPv4 and IPv6 filtering rules, defined in: + + * ``set firewall ipv4 forward filter ...``. + + * ``set firewall ipv6 forward filter ...``. + + * **Output**: The stage where you filter and control traffic that the + router originates. Note that this traffic comes from either a new + connection that an internal process on the VyOS router (such as NTP) + originates or a response to traffic the router receives externally through + **input** (for example, a response to an SSH login attempt). This includes + IPv4 and IPv6 rules, and two different sections apply: + + * **Output Prerouting**: ``set firewall [ipv4 | ipv6] output + raw ...``. As described in **Prerouting**, the system processes + rules in this section before the connection tracking subsystem. + + * **Output Filter**: ``set firewall [ipv4 | ipv6] output filter ...``. + + * **Postrouting**: As in **Prerouting**, you can perform several actions + defined in different parts of VyOS configuration in this stage. This + includes: + + * **Source NAT**: Rules you define under ``set [nat | nat66] + source...``. +``` + +If the interface where the packet was received is part of a bridge, the +packet is processed at the **Bridge Layer**: + +```{eval-rst} + * **Prerouting (Bridge)**: The bridge processes all packets it receives in + this stage, regardless of the destination. First, you can apply filters + here, or you can configure rules that ignore the connection tracking + system. The relevant configuration that applies: + + * ``set firewall bridge prerouting filter ...``. + + * **Forward (Bridge)**: The stage where you filter and control traffic + that passes through the bridge: + + * ``set firewall bridge forward filter ...``. + + * **Input (Bridge)**: The stage where you filter and control traffic + destined for the bridge itself: + + * ``set firewall bridge input filter ...``. + + * **Output (Bridge)**: The stage where you filter and control traffic that + the bridge originates: + + * ``set firewall bridge output filter ...``. +``` + +The following is the overall structure of the VyOS firewall CLI: + +```none +- set firewall + * bridge + - forward + + filter + - input + + filter + - output + + filter + - prerouting + + filter + - name + + custom_name + * flowtable + - custom_flow_table + + ... + * global-options + + all-ping + + broadcast-ping + + ... + * group + - address-group + - ipv6-address-group + - network-group + - ipv6-network-group + - interface-group + - mac-group + - port-group + - domain-group + * ipv4 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - name + + custom_name + * ipv6 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - ipv6-name + + custom_name + * zone + - custom_zone_name + + ... +``` + +Here is a list of VyOS firewall CLI subcommands and their +corresponding pages in the documentation: + +```{cfgcmd} set firewall bridge ... + +Configure bridge firewall rules for traffic at the bridge layer. +See the Bridge Firewall Configuration page for detailed information. +``` + +```{cfgcmd} set firewall flowtable ... + +Configure firewall flowtables for stateful connection tracking and rules. +See the Flowtables Firewall Configuration page for detailed information. +``` + +```{cfgcmd} set firewall global-options ... + +Configure global firewall options such as ``all-ping``, ``broadcast-ping``, +``syn-cookies``, and other system-wide firewall settings. +See the Global Firewall Options page for detailed information. +``` + +```{cfgcmd} set firewall group ... + +Organize firewall rules by creating reusable address, network, interface, +MAC, port, and domain groups. Use groups in multiple rules to simplify +configuration and maintenance. +See the Firewall Groups page for detailed information. +``` + +```{cfgcmd} set firewall ipv4 ... + +Configure IPv4-specific firewall rules. +See the IPv4 Firewall Configuration page for detailed information. +``` + +```{cfgcmd} set firewall ipv6 ... + +Configure IPv6-specific firewall rules. +See the IPv6 Firewall Configuration page for detailed information. +``` + +```{cfgcmd} set firewall zone ... + +Configure zone-based firewall policies for controlling traffic between +different network zones. +See the Zone-Based Firewall Configuration page for detailed information. +``` + +For more information on firewall configuration, see the following pages: + +```{toctree} +:includehidden: true +:maxdepth: 1 + +global-options +groups +bridge +ipv4 +ipv6 +flowtables +``` + +:::{note} +For more information on Netfilter hooks and Linux networking packet flows, +see the [Netfilter-Hooks]() +documentation. +::: + +## Zone-Based firewall + +```{toctree} +:includehidden: true +:maxdepth: 1 + +zone +``` + +With zone-based firewalls, a new concept applies. In addition to the standard +in and out traffic flows, a local flow enables traffic originating from and +destined to the router itself. This means you must configure additional rules to +secure the firewall from the network, in addition to the existing inbound and +outbound rules. + +To configure VyOS with zone-based firewall, see +{doc}`Zone-Based Firewall Configuration `. + +As the following example image shows, you must configure rules to allow or block +traffic to or from the services running on the device that have open +connections on that interface. + +:::{figure} /_static/images/firewall-zonebased.webp +::: diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst deleted file mode 100644 index c4b3c808..00000000 --- a/docs/configuration/firewall/index.rst +++ /dev/null @@ -1,267 +0,0 @@ -:lastproofread: 2026-03-30 - -######## -Firewall -######## - -.. warning:: Due to a boot-time race condition, all interfaces initialize - before the firewall. This temporarily leaves the system open to all traffic - and poses a security risk. - -VyOS uses Netfilter. The Netfilter -project developed ``iptables`` and its successor ``nftables`` for the Linux -kernel to process packet data flows directly. This extends the concept of -zone-based security to let you manipulate data at multiple stages after the -network interface and driver accept it, and before sending it to its -destination (for example, a web server or another device). - -The following is a simplified traffic flow diagram based on Netfilter -packet flow. -This diagram provides an overview of how packets are processed and the -possible paths traffic can take. - -.. figure:: /_static/images/firewall-gral-packet-flow.* - -The main points regarding packet flow and terminology in VyOS firewall -are: - - * **Bridge Port?**: Choose the appropriate path based on whether the - interface where the packet was received is part of a bridge. - -If the interface where the packet was received is not part of a bridge, the -packet is processed at the **IP Layer**: - - * **Prerouting**: The router processes all packets in this stage, - regardless of the destination. You can perform several actions in - this stage, and these actions are also defined in different parts of the - VyOS configuration. Order is important. The relevant configuration that - applies in this stage includes: - - * **Firewall prerouting**: Rules you define under ``set firewall - [ipv4 | ipv6] prerouting raw...``. The system processes all rules in - this section before the connection tracking subsystem. - - * **Conntrack Ignore**: Rules you define under ``set system conntrack - ignore [ipv4 | ipv6] ...``. You can configure this section with - ``firewall [ipv4 | ipv6] prerouting ...``. For compatibility reasons, - this feature is supported, but will be deprecated in the future. - - * **Policy Route**: Rules you define under ``set policy [route | - route6] ...``. - - * **Destination NAT**: Rules you define under ``set [nat | nat66] - destination...``. - - * **Destination is the router?**: Choose the appropriate path based on the - destination IP address. Transit traffic continues to **forward**, while - traffic destined for the router continues to **input**. - - * **Input**: The stage where you filter and control traffic destined for - the router itself. This is where you enforce all rules for securing the - router. This includes IPv4 and IPv6 filtering rules, defined in: - - * ``set firewall ipv4 input filter ...``. - - * ``set firewall ipv6 input filter ...``. - - * **Forward**: The stage where you filter and control transit traffic. - This includes IPv4 and IPv6 filtering rules, defined in: - - * ``set firewall ipv4 forward filter ...``. - - * ``set firewall ipv6 forward filter ...``. - - * **Output**: The stage where you filter and control traffic that the - router originates. Note that this traffic comes from either a new - connection that an internal process on the VyOS router (such as NTP) - originates or a response to traffic the router receives externally through - **input** (for example, a response to an SSH login attempt). This includes - IPv4 and IPv6 rules, and two different sections apply: - - * **Output Prerouting**: ``set firewall [ipv4 | ipv6] output - filter ...``. As described in **Prerouting**, the system processes - rules in this section before the connection tracking subsystem. - - * **Output Filter**: ``set firewall [ipv4 | ipv6] output filter ...``. - - * **Postrouting**: As in **Prerouting**, you can perform several actions - defined in different parts of VyOS configuration in this stage. This - includes: - - * **Source NAT**: Rules you define under ``set [nat | nat66] - destination...``. - -If the interface where the packet was received is part of a bridge, the -packet is processed at the **Bridge Layer**: - - * **Prerouting (Bridge)**: The bridge processes all packets it receives in - this stage, regardless of the destination. First, you can apply filters - here, or you can configure rules that ignore the connection tracking - system. The relevant configuration that applies: - - * ``set firewall bridge prerouting filter ...``. - - * **Forward (Bridge)**: The stage where you filter and control traffic - that passes through the bridge: - - * ``set firewall bridge forward filter ...``. - - * **Input (Bridge)**: The stage where you filter and control traffic - destined for the bridge itself: - - * ``set firewall bridge input filter ...``. - - * **Output (Bridge)**: The stage where you filter and control traffic that - the bridge originates: - - * ``set firewall bridge output filter ...``. - -The following is the overall structure of the VyOS firewall CLI: - -.. code-block:: none - - - set firewall - * bridge - - forward - + filter - - input - + filter - - output - + filter - - prerouting - + filter - - name - + custom_name - * flowtable - - custom_flow_table - + ... - * global-options - + all-ping - + broadcast-ping - + ... - * group - - address-group - - ipv6-address-group - - network-group - - ipv6-network-group - - interface-group - - mac-group - - port-group - - domain-group - * ipv4 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name - * ipv6 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - ipv6-name - + custom_name - * zone - - custom_zone_name - + ... - -Here is a list of VyOS firewall CLI subcommands and their -corresponding pages in the documentation: - -.. cfgcmd:: set firewall bridge ... - - Configure bridge firewall rules for traffic at the bridge layer. For detailed - information, see - :doc:`Bridge Firewall Configuration`. - -.. cfgcmd:: set firewall flowtable ... - - Configure firewall flowtables for stateful connection tracking and rules. - For detailed information, see - :doc:`Flowtables Firewall Configuration ` - . - -.. cfgcmd:: set firewall global-options ... - - Configure global firewall options such as ``all-ping``, ``broadcast-ping``, - ``syn-cookies``, and other system-wide firewall settings. For detailed - information, see - :doc:`Global Firewall Options`. - -.. cfgcmd:: set firewall group ... - - Organize firewall rules by creating reusable address, network, interface, - MAC, port, and domain groups. Use groups in multiple rules to simplify - configuration and maintenance. For detailed information, see - :doc:`Firewall Groups`. - -.. cfgcmd:: set firewall ipv4 ... - - Configure IPv4-specific firewall rules. For detailed information, see - :doc:`IPv4 Firewall Configuration`. - -.. cfgcmd:: set firewall ipv6 ... - - Configure IPv6-specific firewall rules. For detailed information, see - :doc:`IPv6 Firewall Configuration`. - -.. cfgcmd:: set firewall zone ... - - Configure zone-based firewall policies for controlling traffic between - different network zones. For detailed information, see - :doc:`Zone-Based Firewall Configuration`. - -For more information on firewall configuration, see the following pages: - -.. toctree:: - :maxdepth: 1 - :includehidden: - - global-options - groups - bridge - ipv4 - ipv6 - flowtables - -.. note:: - For more information on Netfilter hooks and Linux networking packet flows, - see the `Netfilter-Hooks - `_ - documentation. - - -Zone-Based firewall -^^^^^^^^^^^^^^^^^^^ - -.. toctree:: - :maxdepth: 1 - :includehidden: - - zone - -With zone-based firewalls, a new concept applies. In addition to the standard -in and out traffic flows, a local flow enables traffic originating from and -destined to the router itself. This means you must configure additional rules to -secure the firewall from the network, in addition to the existing inbound and -outbound rules. - -To configure VyOS with zone-based firewall, see -:doc:`Zone-Based Firewall Configuration `. - -As the following example image shows, you must configure rules to allow or block -traffic to or from the services running on the device that have open -connections on that interface. - -.. figure:: /_static/images/firewall-zonebased.* diff --git a/docs/configuration/firewall/ipv4.md b/docs/configuration/firewall/ipv4.md new file mode 100644 index 00000000..e5c0a986 --- /dev/null +++ b/docs/configuration/firewall/ipv4.md @@ -0,0 +1,1517 @@ +--- +lastproofread: '2026-03-30' +--- + +(firewall-ipv4-configuration)= + +# IPv4 Firewall Configuration + +## Overview + +This section provides information on IPv4 firewall configuration and +appropriate operation-mode commands. This section covers the following +configuration commands: + +```{cfgcmd} set firewall ipv4 ... +``` + +To learn about the general traffic flow in VyOS firewalls, see {doc}`Firewall `. + +```none +- set firewall + * ipv4 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - name + + custom_name +``` + +First, the router receives all traffic and processes it in the **prerouting** +stage. + +This stage includes: + +- **Firewall Prerouting**: commands found under `set firewall ipv4 + prerouting raw ...` +- {doc}`Conntrack Ignore`: `set system + conntrack ignore ipv4...` +- {doc}`Policy Route`: commands found under + `set policy route ...` +- {doc}`Destination NAT`: commands found under + `set nat destination ...` + +For transit traffic, which is received by the router and forwarded, the base +chain is **forward**. The following is a simplified packet flow diagram for +transit traffic: + +:::{figure} /_static/images/firewall-fwd-packet-flow.webp +::: + +The base firewall chain for configuring filtering rules for transit traffic is +`set firewall ipv4 forward filter ...`, which occurs in stage 5, highlighted +in red. + +For traffic to the router itself, the base chain is **input**. For traffic +the router originates, the base chain is **output**. A simplified packet flow +diagram is shown next, which shows the path for traffic destined to the router +itself and traffic the router generates (starting from circle number 6): + +:::{figure} /_static/images/firewall-input-packet-flow.webp +::: + +The base chain for traffic towards the router is +`set firewall ipv4 input filter ...` + +The base chain for traffic the router generates is `set firewall ipv4 +output ...`, where two sub-chains are available: **filter** and **raw**: + +- **Output Prerouting**: `set firewall ipv4 output raw ...`. As described + in **Prerouting**, the system processes rules in this section before the + connection tracking subsystem. +- **Output Filter**: `set firewall ipv4 output filter ...`. The system + processes rules in this section after the connection tracking subsystem. + +:::{note} +**Important note about default-actions:** +If you do not define a default action for a base chain, the system sets +the default action to **accept** for that chain. For custom chains, if you +do not define a default action, the system sets the default-action to +**drop**. +::: + +You can create custom firewall chains using the following commands: +`set firewall ipv4 name ...`. To use a custom chain, you must define +a rule with the **action jump** and the appropriate **target** in a base +chain. + +## Firewall - IPv4 Rules + +Each firewall rule has a +number, an action to apply if the rule matches, and the ability to specify +multiple matching criteria. Packets traverse rules numbered 1-999999, so order +is crucial. The system executes the rule action at the first match. + +### Actions + +If you define a rule, you must define an action for it. The action tells the +firewall what to do if all the criteria you define for that rule are met. + +The action can be: + +- `accept`: Accept the packet. +- `continue`: Continue parsing the next rule. +- `drop`: Drop the packet. +- `reject`: Reject the packet. +- `jump`: Jump to another custom chain. +- `return`: Return from the current chain and continue at the next rule + of the last chain. +- `queue`: Enqueue packet to userspace. +- `synproxy`: Synproxy the packet. + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] + +This required setting defines the action of the current rule. If you set +the action to jump, you must also specify a jump-target. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> jump-target \ + +Use this command only when the action is set to ``jump``. Specify the +jump target. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> queue \<0-65535\> + +Use this command only when the action is set to ``queue``. Specify the +queue target to use. Queue range is also supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> queue-options bypass + +Use this command only when the action is set to ``queue``. Allow the packet +to pass through the firewall when no userspace software is connected to the +queue. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> queue-options fanout + +Use this command only when the action is set to ``queue``. Distribute +packets between several queues. +``` + +Also, **default-action** is an action that applies when a packet does not +match any rule in its chain. For base chains, possible options for +**default-action** are **accept** or **drop**. + +```{cfgcmd} set firewall ipv4 forward filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall ipv4 input filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall ipv4 output filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall ipv4 name \ default-action [accept | drop | jump | queue | reject | return] + +This command sets the default action of the rule-set if a packet does not +match the criteria of any rule. If you set the default-action to ``jump``, +you must also specify ``default-jump-target``. Note that for base chains, +you can set the default action only to ``accept`` or ``drop``, while on +custom chains, more actions are available. +``` + +```{cfgcmd} set firewall ipv4 name \ default-jump-target \ + +Use this command only when you set ``default-action`` to ``jump``. Specify +the jump target for the default rule. +``` +:::{note} +**Important note about default-actions:** +If you do not define a default action for a base chain, the system sets +the default action to **accept** for that chain. For custom chains, if you +do not define a default action, the system sets the default-action to +**drop**. +::: + +### Firewall Logs + +You can enable logging for every single firewall rule. If you enable logging, +you can define other log options. + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log + +Enable logging for the matched packet. If this command is not present, then +logging is not enabled. +``` + +```{cfgcmd} set firewall ipv4 forward filter default-log +``` + +```{cfgcmd} set firewall ipv4 input filter default-log +``` + +```{cfgcmd} set firewall ipv4 output filter default-log +``` + +```{cfgcmd} set firewall ipv4 name \ default-log + +Use this command to enable logging of the default action on the specified +chain. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] + +Define the log level. Only applicable if you enable rule logging. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options group \<0-65535\> + +Define the log group to send messages to. Only applicable if you enable rule +logging. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options snapshot-length \<0-9000\> + +Define the length of packet payload to include in a netlink message. Only +applicable if you enable rule logging and define the log group. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options queue-threshold \<0-65535\> + +Define the number of packets to queue inside the kernel before sending them +to userspace. Only applicable if you enable rule logging and define the log +group. +``` + +### Firewall Description + +You can add a description for reference for every single rule and for every +defined custom chain. + +```{cfgcmd} set firewall ipv4 name \ description \ + +Provide a rule-set description for a custom firewall chain. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> description \ + +Provide a description for each rule. +``` + +### Rule Status + +When you define a rule, it is enabled by default. In some cases, it is useful +to disable the rule rather than removing it. + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> disable + +Command for disabling a rule but keeping it in the configuration. +``` + +### Matching criteria + +There are a lot of matching criteria against which the packet can be tested. + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> connection-status nat [destination | source] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> connection-status nat [destination | source] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> connection-status nat [destination | source] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> connection-status nat [destination | source] + +Match based on nat connection status. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> connection-mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> connection-mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> connection-mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> connection-mark \<1-2147483647\> + +Match based on connection mark. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> conntrack-helper \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> conntrack-helper \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> conntrack-helper \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> conntrack-helper \ + +Match based on connection tracking protocol helper module to secure use of +that helper module. See below for possible completions \. + +:::{code-block} none +Possible completions: +ftp Related traffic from FTP helper +h323 Related traffic from H.323 helper +pptp Related traffic from PPTP helper +nfs Related traffic from NFS helper +sip Related traffic from SIP helper +tftp Related traffic from TFTP helper +sqlnet Related traffic from SQLNet helper +::: +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination address [address | addressrange | CIDR] + +Match criteria based on source and/or destination address. This is similar +to the network groups part, but here you are able to negate the matching +addresses. + +:::{code-block} none +set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11 +# with a '!' the rule match everything except the specified subnet +set firewall ipv4 name FOO rule 51 source address !203.0.113.0/24 +::: +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination address-mask [address] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination address-mask [address] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination address-mask [address] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination address-mask [address] + +An arbitrary netmask can be applied to mask addresses to only match against +a specific portion. + +This functions for both individual addresses and address groups. + +:::{code-block} none +# Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet +set firewall ipv4 name FOO rule 100 destination address 0.11.0.13 +set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255 +::: +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination fqdn \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination fqdn \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination fqdn \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination fqdn \ + +Specify a Fully Qualified Domain Name as source/destination to match. Ensure +that the router is able to resolve this dns query. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination geoip inverse-match +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination geoip inverse-match +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination geoip inverse-match +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination geoip inverse-match + +Match IP addresses based on its geolocation. More info: geoip matching. +Use inverse-match to match anything except the given country-codes. +``` + +Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, +permits redistribution so we can include a database in images(~3MB +compressed). Includes cron script (manually callable by op-mode update +geoip) to keep database and rules updated. + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source mac-address \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source mac-address \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source mac-address \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source mac-address \ + +You can only specify a source mac-address to match. + +:::{code-block} none +set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33 +set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34 +::: +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination port [1-65535 | portname | start-end] + +A port can be set by number or name as defined in ``/etc/services``. + +:::{code-block} none +set firewall ipv4 forward filter rule 10 source port '22' +set firewall ipv4 forward filter rule 11 source port '!http' +set firewall ipv4 forward filter rule 12 source port 'https' +::: +Multiple source ports can be specified as a comma-separated list. +The whole list can also be "negated" using ``!``. For example: +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group address-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group address-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group address-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group address-group \ + +Use a specific address-group. Prepending the character ``!`` to invert the +criteria to match is also supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group dynamic-address-group \ + +Use a specific dynamic-address-group. Prepending the character ``!`` to +invert the criteria to match is also supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group network-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group network-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group network-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group network-group \ + +Use a specific network-group. Prepending the character ``!`` to invert the +criteria to match is also supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group port-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group port-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group port-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group port-group \ + +Use a specific port-group. Prepending the character ``!`` to invert the +criteria to match is also supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group domain-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group domain-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group domain-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group domain-group \ + +Use a specific domain-group. Prepending the character ``!`` to invert the +criteria to match is also supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group mac-group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group mac-group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group mac-group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group mac-group \ + +Use a specific mac-group. Prepending the character ``!`` to invert the +criteria to match is also supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> dscp-exclude [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> dscp-exclude [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> dscp-exclude [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> dscp-exclude [0-63 | start-end] + +Match based on dscp value. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> fragment [match-frag | match-non-frag] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> fragment [match-frag | match-non-frag] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> fragment [match-frag | match-non-frag] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> fragment [match-frag | match-non-frag] + +Match based on fragmentation. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> icmp [code | type] \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> icmp [code | type] \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> icmp [code | type] \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> icmp [code | type] \<0-255\> + +Match based on icmp code and type. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> icmp type-name \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> icmp type-name \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> icmp type-name \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> icmp type-name \ + +Match based on icmp type-name. Use tab for information +about what **type-name** criteria are supported. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> inbound-interface name \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> inbound-interface name \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> inbound-interface name \ + +Match based on inbound interface. Wildcard ``*`` is supported. For example: +``eth2*``. Prepend the character ``!`` to invert the criteria. For example: +``!eth2`` +``` +:::{note} +If an interface is attached to a non-default vrf, when using +**inbound-interface**, the vrf name must be used. For example `set firewall +ipv4 forward filter rule 10 inbound-interface name MGMT` +::: +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> inbound-interface group \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> inbound-interface group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> inbound-interface group \ + +Match based on the inbound interface group. Prepend the character ``!`` to +invert the criteria. For example, ``!IFACE_GROUP`` +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> outbound-interface name \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> outbound-interface name \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> outbound-interface name \ + +Match based on outbound interface. Wildcard ``*`` is supported. For example: +``eth2*``. Prepend the character ``!`` to invert the criteria. For example: +``!eth2`` +``` +:::{note} +If an interface is attached to a non-default vrf, when using +**outbound-interface**, the real interface name must be used. For example +`set firewall ipv4 forward filter rule 10 outbound-interface name eth0` +::: +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> outbound-interface group \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> outbound-interface group \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> outbound-interface group \ + +Match based on outbound interface group. Prepend the character ``!`` to +invert the criteria. For example: ``!IFACE_GROUP`` +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> ipsec [match-ipsec-in | match-none-in] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> ipsec [match-ipsec-out | match-none-out] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] + +Match based on ipsec. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> limit burst \<0-4294967295\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> limit burst \<0-4294967295\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> limit burst \<0-4294967295\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> limit burst \<0-4294967295\> + +Match based on the maximum number of packets to allow in excess of rate. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> limit rate \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> limit rate \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> limit rate \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> limit rate \ + +Specify the maximum average rate as **integer/unit**. For example: +**5/minutes** +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> packet-length-exclude \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> packet-length-exclude \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> packet-length-exclude \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> packet-length-exclude \ + +Match based on packet length. Specify multiple values from 1 to 65535 and +ranges. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> packet-type [broadcast | host | multicast | other] + +Match based on the packet type. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] + +Match based on protocol number or name as defined in ``/etc/protocols``. +Special names are ``all`` for all protocols and ``tcp_udp`` for TCP and UDP +based packets. The ``!`` character negates the selected protocol. + +:::{code-block} none +set firewall ipv4 forward filter rule 10 protocol tcp_udp +set firewall ipv4 forward filter rule 11 protocol !tcp_udp +::: +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> recent time [second | minute | hour] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> recent time [second | minute | hour] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> recent time [second | minute | hour] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> recent time [second | minute | hour] + +Match based on recently seen sources. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> tcp flags [not] \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> tcp flags [not] \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> tcp flags [not] \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> tcp flags [not] \ + +Specify TCP flags. Allowed values are ``ack``, ``cwr``, ``ecn``, ``fin``, +``psh``, ``rst``, ``syn``, and ``urg``. Specify multiple values, and use +``not`` for inverted selection, as shown in the example. + +:::{code-block} none +set firewall ipv4 input filter rule 10 tcp flags 'ack' +set firewall ipv4 input filter rule 12 tcp flags 'syn' +set firewall ipv4 input filter rule 13 tcp flags not 'fin' +::: +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> state [established | invalid | new | related] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> state [established | invalid | new | related] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> state [established | invalid | new | related] +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> state [established | invalid | new | related] + +Match against the state of a packet. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time weekdays \ +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time weekdays \ +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time weekdays \ +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time weekdays \ + +Time to match the defined rule. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> ttl \ \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> ttl \ \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> ttl \ \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> ttl \ \<0-255\> + +Match the time to live parameter, where 'eq' means 'equal', 'gt' means +'greater than', and 'lt' means 'less than'. +``` + +### Packet Modifications + +Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify +packets before sending them out. This feature provides more flexibility in +packet handling. + +```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set dscp \<0-63\> +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set dscp \<0-63\> +``` + +```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set dscp \<0-63\> + +Set a specific value of Differentiated Services Codepoint (DSCP). +``` + +```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set mark \<1-2147483647\> + +Set a specific packet mark value. +``` + +```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set tcp-mss \<500-1460\> +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set tcp-mss \<500-1460\> +``` + +```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set tcp-mss \<500-1460\> + +Set the TCP-MSS (TCP maximum segment size) for the connection. +``` + +```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set ttl \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set ttl \<0-255\> +``` + +```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set ttl \<0-255\> + +Set the TTL (Time to Live) value. +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set connection-mark \<0-2147483647\> +``` + +```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set connection-mark \<0-2147483647\> + +Set connection mark value. +``` + +## Synproxy + +Synproxy connections + +```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> action synproxy +``` + +```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> protocol tcp +``` + +```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> synproxy tcp mss \<501-65535\> + + Set the TCP-MSS (maximum segment size) for the connection +``` + +```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> synproxy tcp window-scale \<1-14\> + + Set the window scale factor for TCP window scaling +``` + +### Example synproxy + +Requirements to enable synproxy: + +- Traffic must be symmetric. +- Synproxy relies on syncookies and TCP timestamps, ensure these are enabled. +- Disable conntrack loose track option. + +```none +set system sysctl parameter net.ipv4.tcp_timestamps value '1' + +set system conntrack tcp loose disable + +set system conntrack ignore ipv4 rule 10 destination port '8080' + +set system conntrack ignore ipv4 rule 10 protocol 'tcp' + +set system conntrack ignore ipv4 rule 10 tcp flags syn + +set firewall global-options syn-cookies 'enable' + +set firewall ipv4 input filter rule 10 action 'synproxy' + +set firewall ipv4 input filter rule 10 destination port '8080' + +set firewall ipv4 input filter rule 10 inbound-interface name 'eth1' + +set firewall ipv4 input filter rule 10 protocol 'tcp' + +set firewall ipv4 input filter rule 10 synproxy tcp mss '1460' + +set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7' + +set firewall ipv4 input filter rule 1000 action 'drop' + +set firewall ipv4 input filter rule 1000 state invalid + +``` + +## Operation-mode Firewall + +### Rule-set overview + +```{opcmd} show firewall + +This will show you a basic firewall overview, for all rule-sets, not +only for IPv4. + +:::{code-block} none +vyos@vyos:~$ show firewall +Rulesets Information + +--------------------------------- +ipv4 Firewall "forward filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ----------------------------- +20 accept all 0 0 ip saddr @N_TRUSTEDv4 accept +21 jump all 0 0 jump NAME_AUX +default accept all 0 0 + +--------------------------------- +ipv4 Firewall "input filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ------------------------- +10 accept all 156 14377 iifname != @I_LAN accept +default accept all 0 0 + +--------------------------------- +ipv4 Firewall "name AUX" + +Rule Action Protocol Packets Bytes Conditions +------ -------- ---------- --------- ------- -------------------------------------------- +10 accept icmp 0 0 meta l4proto icmp accept +20 accept udp 0 0 meta l4proto udp ip saddr @A_SERVERS accept +30 drop all 0 0 ip saddr != @A_SERVERS iifname "eth2" + +--------------------------------- +ipv4 Firewall "output filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------------------------- +10 reject all 0 0 oifname @I_LAN +20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept +default accept all 72 9258 + +--------------------------------- +ipv6 Firewall "input filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ------------------------------- +10 accept all 0 0 ip6 saddr @N6_TRUSTEDv6 accept +default accept all 2 112 + +vyos@vyos:~$ +::: +``` + +```{opcmd} show firewall summary + +This shows you a summary of rule-sets and groups. + +:::{code-block} none +vyos@vyos:~$ show firewall summary +Ruleset Summary + +IPv6 Ruleset: + +Ruleset Hook Ruleset Priority Description +-------------- -------------------- ------------------------- +forward filter +input filter +ipv6_name IPV6-VyOS_MANAGEMENT +ipv6_name IPV6-WAN_IN PUBLIC_INTERNET + +IPv4 Ruleset: + +Ruleset Hook Ruleset Priority Description +-------------- ------------------ ------------------------- +forward filter +input filter +name VyOS_MANAGEMENT +name WAN_IN PUBLIC_INTERNET + +Firewall Groups + +Name Type References Members +----------------------- ------------------ ----------------------- ---------------- +PBX address_group WAN_IN-100 198.51.100.77 +SERVERS address_group WAN_IN-110 192.0.2.10 +WAN_IN-111 192.0.2.11 +WAN_IN-112 192.0.2.12 +WAN_IN-120 +WAN_IN-121 +WAN_IN-122 +SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 +WAN_IN-20 +PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 +PINGABLE_ADDRESSES address_group WAN_IN-170 192.168.5.2 +WAN_IN-171 +PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 +SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 +IPV6-WAN_IN-111 2001:db8::3 +IPV6-WAN_IN-112 2001:db8::4 +IPV6-WAN_IN-120 +IPV6-WAN_IN-121 +IPV6-WAN_IN-122 +SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 +IPV6-WAN_IN-20 +::: +``` + +```{opcmd} show firewall ipv4 [forward | input | output] filter +``` + +```{opcmd} show firewall ipv4 name \ + +This command will give an overview of a single rule-set. + +:::{code-block} none +vyos@vyos:~$ show firewall ipv4 input filter +Ruleset Information +--------------------------------- +IPv4 Firewall "input filter" +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ----------------------------------------- +5 jump all 0 0 iifname "eth2" jump NAME_VyOS_MANAGEMENT +default accept all +::: +``` + +```{opcmd} show firewall ipv4 [forward | input | output] filter rule \<1-999999\> +``` + +```{opcmd} show firewall ipv4 name \ rule \<1-999999\> + +This command gives an overview of a rule in a single rule-set, plus +information for default action. +``` +```none +vyos@vyos:~$show firewall ipv4 output filter rule 20 +Rule Information + +--------------------------------- +ipv4 Firewall "output filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------------------------- +20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept +default accept all 286 47614 + +vyos@vyos:~$ +``` + +```{opcmd} show firewall statistics + +This will show you statistics of all rule-sets since the last boot. +``` + +### Show Firewall log + +```{opcmd} show log firewall + +``` +```{opcmd} show log firewall ipv4 +``` + +```{opcmd} show log firewall ipv4 [forward | input | output | name] +``` + +```{opcmd} show log firewall ipv4 [forward | input | output] filter +``` + +```{opcmd} show log firewall ipv4 name \ +``` + +```{opcmd} show log firewall ipv4 [forward | input | output] filter rule \ +``` + +```{opcmd} show log firewall ipv4 name \ rule \ + +Show the logs of all firewall; show all IPv4 firewall logs; show all logs +for particular hook; show all logs for particular hook and priority; +show all logs for particular custom chain; show logs for specific rule-set. +``` + +### Example Partial Config + +```none +firewall { + group { + network-group BAD-NETWORKS { + network 198.51.100.0/24 + network 203.0.113.0/24 + } + network-group GOOD-NETWORKS { + network 192.0.2.0/24 + } + port-group BAD-PORTS { + port 65535 + } + } + ipv4 { + forward { + filter { + default-action accept + rule 5 { + action accept + source { + group { + network-group GOOD-NETWORKS + } + } + } + rule 10 { + action drop + description "Bad Networks" + protocol all + source { + group { + network-group BAD-NETWORKS + } + } + } + } + } + } +} +``` + +### Update geoip database + +```{opcmd} update geoip + +Command to update GeoIP database and firewall sets. +``` \ No newline at end of file diff --git a/docs/configuration/firewall/ipv4.rst b/docs/configuration/firewall/ipv4.rst deleted file mode 100644 index efd0fe18..00000000 --- a/docs/configuration/firewall/ipv4.rst +++ /dev/null @@ -1,1305 +0,0 @@ -:lastproofread: 2026-03-30 - -.. _firewall-ipv4-configuration: - -########################### -IPv4 Firewall Configuration -########################### - -******** -Overview -******** - -This section provides information on IPv4 firewall configuration and -appropriate operation-mode commands. This section covers the following -configuration commands: - -.. cfgcmd:: set firewall ipv4 ... - -To learn about the general traffic flow in VyOS firewalls, -see :doc:`Firewall `. - -.. code-block:: none - - - set firewall - * ipv4 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name - -First, the router receives all traffic and processes it in the **prerouting** -stage. - -This stage includes: - - * **Firewall Prerouting**: commands found under ``set firewall ipv4 - prerouting raw ...`` - * :doc:`Conntrack Ignore`: ``set system - conntrack ignore ipv4...`` - * :doc:`Policy Route`: commands found under - ``set policy route ...`` - * :doc:`Destination NAT`: commands found under - ``set nat destination ...`` - -For transit traffic, which is received by the router and forwarded, the base -chain is **forward**. The following is a simplified packet flow diagram for -transit traffic: - -.. figure:: /_static/images/firewall-fwd-packet-flow.* - -The base firewall chain for configuring filtering rules for transit traffic is -``set firewall ipv4 forward filter ...``, which occurs in stage 5, highlighted -in red. - -For traffic to the router itself, the base chain is **input**. For traffic -the router originates, the base chain is **output**. A simplified packet flow -diagram is shown next, which shows the path for traffic destined to the router -itself and traffic the router generates (starting from circle number 6): - -.. figure:: /_static/images/firewall-input-packet-flow.* - -The base chain for traffic towards the router is -``set firewall ipv4 input filter ...`` - -The base chain for traffic the router generates is ``set firewall ipv4 -output ...``, where two sub-chains are available: **filter** and **raw**: - -* **Output Prerouting**: ``set firewall ipv4 output raw ...``. As described - in **Prerouting**, the system processes rules in this section before the - connection tracking subsystem. -* **Output Filter**: ``set firewall ipv4 output filter ...``. The system - processes rules in this section after the connection tracking subsystem. - -.. note:: **Important note about default-actions:** - If you do not define a default action for a base chain, the system sets - the default action to **accept** for that chain. For custom chains, if you - do not define a default action, the system sets the default-action to - **drop**. - -You can create custom firewall chains using the following commands: -``set firewall ipv4 name ...``. To use a custom chain, you must define -a rule with the **action jump** and the appropriate **target** in a base -chain. - -********************* -Firewall - IPv4 Rules -********************* - -Each firewall rule has a -number, an action to apply if the rule matches, and the ability to specify -multiple matching criteria. Packets traverse rules numbered 1-999999, so order -is crucial. The system executes the rule action at the first match. - -Actions -======= - -If you define a rule, you must define an action for it. The action tells the -firewall what to do if all the criteria you define for that rule are met. - -The action can be: - - * ``accept``: Accept the packet. - - * ``continue``: Continue parsing the next rule. - - * ``drop``: Drop the packet. - - * ``reject``: Reject the packet. - - * ``jump``: Jump to another custom chain. - - * ``return``: Return from the current chain and continue at the next rule - of the last chain. - - * ``queue``: Enqueue packet to userspace. - - * ``synproxy``: Synproxy the packet. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] - - This required setting defines the action of the current rule. If you set - the action to jump, you must also specify a jump-target. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - jump-target - - Use this command only when the action is set to ``jump``. Specify the - jump target. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - queue <0-65535> - - Use this command only when the action is set to ``queue``. Specify the - queue target to use. Queue range is also supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - queue-options bypass - - Use this command only when the action is set to ``queue``. Allow the packet - to pass through the firewall when no userspace software is connected to the - queue. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - queue-options fanout - - Use this command only when the action is set to ``queue``. Distribute - packets between several queues. - -Also, **default-action** is an action that applies when a packet does not -match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -.. cfgcmd:: set firewall ipv4 forward filter default-action - [accept | drop] -.. cfgcmd:: set firewall ipv4 input filter default-action - [accept | drop] -.. cfgcmd:: set firewall ipv4 output filter default-action - [accept | drop] -.. cfgcmd:: set firewall ipv4 name default-action - [accept | drop | jump | queue | reject | return] - - This command sets the default action of the rule-set if a packet does not - match the criteria of any rule. If you set the default-action to ``jump``, - you must also specify ``default-jump-target``. Note that for base chains, - you can set the default action only to ``accept`` or ``drop``, while on - custom chains, more actions are available. - -.. cfgcmd:: set firewall ipv4 name default-jump-target - - Use this command only when you set ``default-action`` to ``jump``. Specify - the jump target for the default rule. - -.. note:: **Important note about default-actions:** - If you do not define a default action for a base chain, the system sets - the default action to **accept** for that chain. For custom chains, if you - do not define a default action, the system sets the default-action to - **drop**. - -Firewall Logs -============= - -You can enable logging for every single firewall rule. If you enable logging, -you can define other log options. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> log -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> log -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> log -.. cfgcmd:: set firewall ipv4 name rule <1-999999> log - - Enable logging for the matched packet. If this command is not present, then - logging is not enabled. - -.. cfgcmd:: set firewall ipv4 forward filter default-log -.. cfgcmd:: set firewall ipv4 input filter default-log -.. cfgcmd:: set firewall ipv4 output filter default-log -.. cfgcmd:: set firewall ipv4 name default-log - - Use this command to enable logging of the default action on the specified - chain. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] - - Define the log level. Only applicable if you enable rule logging. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options group <0-65535> - - Define the log group to send messages to. Only applicable if you enable rule - logging. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options snapshot-length <0-9000> - - Define the length of packet payload to include in a netlink message. Only - applicable if you enable rule logging and define the log group. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options queue-threshold <0-65535> - - Define the number of packets to queue inside the kernel before sending them - to userspace. Only applicable if you enable rule logging and define the log - group. - -Firewall Description -==================== - -You can add a description for reference for every single rule and for every -defined custom chain. - -.. cfgcmd:: set firewall ipv4 name description - - Provide a rule-set description for a custom firewall chain. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - description -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - description -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - description -.. cfgcmd:: set firewall ipv4 name rule <1-999999> description - - Provide a description for each rule. - -Rule Status -=========== - -When you define a rule, it is enabled by default. In some cases, it is useful -to disable the rule rather than removing it. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> disable -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> disable -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> disable -.. cfgcmd:: set firewall ipv4 name rule <1-999999> disable - - Command for disabling a rule but keeping it in the configuration. - -Matching criteria -================= - -There are a lot of matching criteria against which the packet can be tested. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - connection-status nat [destination | source] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - connection-status nat [destination | source] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - connection-status nat [destination | source] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - connection-status nat [destination | source] - - Match based on nat connection status. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - connection-mark <1-2147483647> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - connection-mark <1-2147483647> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - connection-mark <1-2147483647> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - connection-mark <1-2147483647> - - Match based on connection mark. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - conntrack-helper -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - conntrack-helper -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - conntrack-helper -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - conntrack-helper - - Match based on connection tracking protocol helper module to secure use of - that helper module. See below for possible completions ``. - - .. code-block:: none - - Possible completions: - ftp Related traffic from FTP helper - h323 Related traffic from H.323 helper - pptp Related traffic from PPTP helper - nfs Related traffic from NFS helper - sip Related traffic from SIP helper - tftp Related traffic from TFTP helper - sqlnet Related traffic from SQLNet helper - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source address [address | addressrange | CIDR] - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination address [address | addressrange | CIDR] - - Match criteria based on source and/or destination address. This is similar - to the network groups part, but here you are able to negate the matching - addresses. - - .. code-block:: none - - set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11 - # with a '!' the rule match everything except the specified subnet - set firewall ipv4 input filter FOO rule 51 source address !203.0.113.0/24 - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source address-mask [address] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source address-mask [address] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source address-mask [address] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source address-mask [address] - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination address-mask [address] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination address-mask [address] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination address-mask [address] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination address-mask [address] - - An arbitrary netmask can be applied to mask addresses to only match against - a specific portion. - - This functions for both individual addresses and address groups. - - .. code-block:: none - - # Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet - set firewall ipv4 name FOO rule 100 destination address 0.11.0.13 - set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255 - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination fqdn -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination fqdn -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination fqdn -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination fqdn - - Specify a Fully Qualified Domain Name as source/destination to match. Ensure - that the router is able to resolve this dns query. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source geoip country-code -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source geoip country-code -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source geoip country-code -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source geoip country-code - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination geoip country-code -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination geoip country-code -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination geoip country-code -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination geoip country-code - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source geoip inverse-match -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source geoip inverse-match -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source geoip inverse-match -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source geoip inverse-match - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination geoip inverse-match -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination geoip inverse-match -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination geoip inverse-match -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination geoip inverse-match - - Match IP addresses based on its geolocation. More info: `geoip matching - `_. - Use inverse-match to match anything except the given country-codes. - -Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, -permits redistribution so we can include a database in images(~3MB -compressed). Includes cron script (manually callable by op-mode update -geoip) to keep database and rules updated. - - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source mac-address -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source mac-address -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source mac-address -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source mac-address - - You can only specify a source mac-address to match. - - .. code-block:: none - - set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33 - set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34 - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source port [1-65535 | portname | start-end] - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination port [1-65535 | portname | start-end] - - A port can be set by number or name as defined in ``/etc/services``. - - .. code-block:: none - - set firewall ipv4 forward filter rule 10 source port '22' - set firewall ipv4 forward filter rule 11 source port '!http' - set firewall ipv4 forward filter rule 12 source port 'https' - - Multiple source ports can be specified as a comma-separated list. - The whole list can also be "negated" using ``!``. For example: - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group address-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group address-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group address-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group address-group - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group address-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group address-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group address-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group address-group - - Use a specific address-group. Prepending the character ``!`` to invert the - criteria to match is also supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group dynamic-address-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group dynamic-address-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group dynamic-address-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group dynamic-address-group - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group dynamic-address-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group dynamic-address-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group dynamic-address-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group dynamic-address-group - - Use a specific dynamic-address-group. Prepending the character ``!`` to - invert the criteria to match is also supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group network-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group network-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group network-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group network-group - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group network-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group network-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group network-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group network-group - - Use a specific network-group. Prepending the character ``!`` to invert the - criteria to match is also supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group port-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group port-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group port-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group port-group - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group port-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group port-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group port-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group port-group - - Use a specific port-group. Prepending the character ``!`` to invert the - criteria to match is also supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group domain-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group domain-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group domain-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group domain-group - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group domain-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group domain-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group domain-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group domain-group - - Use a specific domain-group. Prepending the character ``!`` to invert the - criteria to match is also supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group mac-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group mac-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group mac-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group mac-group - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group mac-group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group mac-group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group mac-group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group mac-group - - Use a specific mac-group. Prepending the character ``!`` to invert the - criteria to match is also supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - dscp [0-63 | start-end] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - dscp [0-63 | start-end] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - dscp [0-63 | start-end] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - dscp [0-63 | start-end] - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - dscp-exclude [0-63 | start-end] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - dscp-exclude [0-63 | start-end] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - dscp-exclude [0-63 | start-end] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - dscp-exclude [0-63 | start-end] - - Match based on dscp value. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - fragment [match-frag | match-non-frag] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - fragment [match-frag | match-non-frag] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - fragment [match-frag | match-non-frag] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - fragment [match-frag | match-non-frag] - - Match based on fragmentation. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - icmp [code | type] <0-255> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - icmp [code | type] <0-255> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - icmp [code | type] <0-255> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - icmp [code | type] <0-255> - - Match based on icmp code and type. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - icmp type-name -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - icmp type-name -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - icmp type-name -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - icmp type-name - - Match based on icmp type-name. Use tab for information - about what **type-name** criteria are supported. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - inbound-interface name -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - inbound-interface name -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - inbound-interface name - - Match based on inbound interface. Wildcard ``*`` is supported. For example: - ``eth2*``. Prepend the character ``!`` to invert the criteria. For example: - ``!eth2`` - -.. note:: If an interface is attached to a non-default vrf, when using - **inbound-interface**, the vrf name must be used. For example ``set firewall - ipv4 forward filter rule 10 inbound-interface name MGMT`` - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - inbound-interface group -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - inbound-interface group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - inbound-interface group - - Match based on the inbound interface group. Prepend the character ``!`` to - invert the criteria. For example, ``!IFACE_GROUP`` - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - outbound-interface name -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - outbound-interface name -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - outbound-interface name - - Match based on outbound interface. Wildcard ``*`` is supported. For example: - ``eth2*``. Prepend the character ``!`` to invert the criteria. For example: - ``!eth2`` - -.. note:: If an interface is attached to a non-default vrf, when using - **outbound-interface**, the real interface name must be used. For example - ``set firewall ipv4 forward filter rule 10 outbound-interface name eth0`` - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - outbound-interface group -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - outbound-interface group -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - outbound-interface group - - Match based on outbound interface group. Prepend the character ``!`` to - invert the criteria. For example: ``!IFACE_GROUP`` - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - ipsec [match-ipsec-in | match-none-in] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - ipsec [match-ipsec-out | match-none-out] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] - - Match based on ipsec. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - limit burst <0-4294967295> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - limit burst <0-4294967295> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - limit burst <0-4294967295> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - limit burst <0-4294967295> - - Match based on the maximum number of packets to allow in excess of rate. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - limit rate -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - limit rate -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - limit rate -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - limit rate - - Specify the maximum average rate as **integer/unit**. For example: - **5/minutes** - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - packet-length -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - packet-length -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - packet-length -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - packet-length - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - packet-length-exclude -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - packet-length-exclude -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - packet-length-exclude -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - packet-length-exclude - - Match based on packet length. Specify multiple values from 1 to 65535 and - ranges. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - packet-type [broadcast | host | multicast | other] - - Match based on the packet type. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] - - Match based on protocol number or name as defined in ``/etc/protocols``. - Special names are ``all`` for all protocols and ``tcp_udp`` for TCP and UDP - based packets. The ``!`` character negates the selected protocol. - - .. code-block:: none - - set firewall ipv4 forward filter rule 10 protocol tcp_udp - set firewall ipv4 forward filter rule 11 protocol !tcp_udp - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - recent count <1-255> - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - recent time [second | minute | hour] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - recent time [second | minute | hour] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - recent time [second | minute | hour] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - recent time [second | minute | hour] - - Match based on recently seen sources. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - tcp flags [not] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - tcp flags [not] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - tcp flags [not] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - tcp flags [not] - - Specify TCP flags. Allowed values are ``ack``, ``cwr``, ``ecn``, ``fin``, - ``psh``, ``rst``, ``syn``, and ``urg``. Specify multiple values, and use - ``not`` for inverted selection, as shown in the example. - - .. code-block:: none - - set firewall ipv4 input filter rule 10 tcp flags 'ack' - set firewall ipv4 input filter rule 12 tcp flags 'syn' - set firewall ipv4 input filter rule 13 tcp flags not 'fin' - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - state [established | invalid | new | related] -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - state [established | invalid | new | related] -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - state [established | invalid | new | related] -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - state [established | invalid | new | related] - - Match against the state of a packet. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time weekdays -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time weekdays -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time weekdays -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time weekdays - - Time to match the defined rule. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - ttl <0-255> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - ttl <0-255> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - ttl <0-255> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - ttl <0-255> - - Match the time to live parameter, where 'eq' means 'equal', 'gt' means - 'greater than', and 'lt' means 'less than'. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - recent count <1-255> - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - recent time -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - recent time -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - recent time -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - recent time - - Match when 'count' amount of connections appear within 'time'. Use these - matching criteria to block brute-force attempts. - -Packet Modifications -==================== - -Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify -packets before sending them out. This feature provides more flexibility in -packet handling. - -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set dscp <0-63> -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set dscp <0-63> -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set dscp <0-63> - - Set a specific value of Differentiated Services Codepoint (DSCP). - -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set mark <1-2147483647> -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set mark <1-2147483647> -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set mark <1-2147483647> - - Set a specific packet mark value. - -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set tcp-mss <500-1460> -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set tcp-mss <500-1460> -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set tcp-mss <500-1460> - - Set the TCP-MSS (TCP maximum segment size) for the connection. - -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set ttl <0-255> -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set ttl <0-255> -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set ttl <0-255> - - Set the TTL (Time to Live) value. - -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set connection-mark <0-2147483647> -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set connection-mark <0-2147483647> - - Set connection mark value. - -******** -Synproxy -******** -Synproxy connections - -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - action synproxy -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - protocol tcp -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - synproxy tcp mss <501-65535> - - Set the TCP-MSS (maximum segment size) for the connection - -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - synproxy tcp window-scale <1-14> - - Set the window scale factor for TCP window scaling - -Example synproxy -================ -Requirements to enable synproxy: - - * Traffic must be symmetric. - * Synproxy relies on syncookies and TCP timestamps, ensure these are enabled. - * Disable conntrack loose track option. - -.. code-block:: none - - set system sysctl parameter net.ipv4.tcp_timestamps value '1' - - set system conntrack tcp loose disable - set system conntrack ignore ipv4 rule 10 destination port '8080' - set system conntrack ignore ipv4 rule 10 protocol 'tcp' - set system conntrack ignore ipv4 rule 10 tcp flags syn - - set firewall global-options syn-cookies 'enable' - set firewall ipv4 input filter rule 10 action 'synproxy' - set firewall ipv4 input filter rule 10 destination port '8080' - set firewall ipv4 input filter rule 10 inbound-interface name 'eth1' - set firewall ipv4 input filter rule 10 protocol 'tcp' - set firewall ipv4 input filter rule 10 synproxy tcp mss '1460' - set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7' - set firewall ipv4 input filter rule 1000 action 'drop' - set firewall ipv4 input filter rule 1000 state invalid - -*********************** -Operation-mode Firewall -*********************** - -Rule-set overview -================= - -.. opcmd:: show firewall - - This will show you a basic firewall overview, for all rule-sets, not - only for IPv4. - - .. code-block:: none - - vyos@vyos:~$ show firewall - Rulesets Information - - --------------------------------- - ipv4 Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------- - 20 accept all 0 0 ip saddr @N_TRUSTEDv4 accept - 21 jump all 0 0 jump NAME_AUX - default accept all 0 0 - - --------------------------------- - ipv4 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------- - 10 accept all 156 14377 iifname != @I_LAN accept - default accept all 0 0 - - --------------------------------- - ipv4 Firewall "name AUX" - - Rule Action Protocol Packets Bytes Conditions - ------ -------- ---------- --------- ------- -------------------------------------------- - 10 accept icmp 0 0 meta l4proto icmp accept - 20 accept udp 0 0 meta l4proto udp ip saddr @A_SERVERS accept - 30 drop all 0 0 ip saddr != @A_SERVERS iifname "eth2" - - --------------------------------- - ipv4 Firewall "output filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------- - 10 reject all 0 0 oifname @I_LAN - 20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept - default accept all 72 9258 - - --------------------------------- - ipv6 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------------- - 10 accept all 0 0 ip6 saddr @N6_TRUSTEDv6 accept - default accept all 2 112 - - vyos@vyos:~$ - -.. opcmd:: show firewall summary - - This shows you a summary of rule-sets and groups. - - .. code-block:: none - - vyos@vyos:~$ show firewall summary - Ruleset Summary - - IPv6 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- -------------------- ------------------------- - forward filter - input filter - ipv6_name IPV6-VyOS_MANAGEMENT - ipv6_name IPV6-WAN_IN PUBLIC_INTERNET - - IPv4 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- ------------------ ------------------------- - forward filter - input filter - name VyOS_MANAGEMENT - name WAN_IN PUBLIC_INTERNET - - Firewall Groups - - Name Type References Members - ----------------------- ------------------ ----------------------- ---------------- - PBX address_group WAN_IN-100 198.51.100.77 - SERVERS address_group WAN_IN-110 192.0.2.10 - WAN_IN-111 192.0.2.11 - WAN_IN-112 192.0.2.12 - WAN_IN-120 - WAN_IN-121 - WAN_IN-122 - SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 - WAN_IN-20 - PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 - PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2 - WAN_IN-171 - PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 - SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 - IPV6-WAN_IN-111 2001:db8::3 - IPV6-WAN_IN-112 2001:db8::4 - IPV6-WAN_IN-120 - IPV6-WAN_IN-121 - IPV6-WAN_IN-122 - SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 - IPV6-WAN_IN-20 - - -.. opcmd:: show firewall ipv4 [forward | input | output] filter - -.. opcmd:: show firewall ipv4 name - - This command will give an overview of a single rule-set. - - .. code-block:: none - - vyos@vyos:~$ show firewall ipv4 input filter - Ruleset Information - - --------------------------------- - IPv4 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------------------- - 5 jump all 0 0 iifname "eth2" jump NAME_VyOS_MANAGEMENT - default accept all - -.. opcmd:: show firewall ipv4 [forward | input | output] - filter rule <1-999999> -.. opcmd:: show firewall ipv4 name rule <1-999999> - - This command gives an overview of a rule in a single rule-set, plus - information for default action. - -.. code-block:: none - - vyos@vyos:~$show firewall ipv4 output filter rule 20 - Rule Information - - --------------------------------- - ipv4 Firewall "output filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------- - 20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept - default accept all 286 47614 - - vyos@vyos:~$ - - -.. opcmd:: show firewall statistics - - This will show you statistics of all rule-sets since the last boot. - -Show Firewall log -================= - -.. opcmd:: show log firewall -.. opcmd:: show log firewall ipv4 -.. opcmd:: show log firewall ipv4 [forward | input | output | name] -.. opcmd:: show log firewall ipv4 [forward | input | output] filter -.. opcmd:: show log firewall ipv4 name -.. opcmd:: show log firewall ipv4 [forward | input | output] filter rule -.. opcmd:: show log firewall ipv4 name rule - - Show the logs of all firewall; show all IPv4 firewall logs; show all logs - for particular hook; show all logs for particular hook and priority; - show all logs for particular custom chain; show logs for specific rule-set. - -Example Partial Config -====================== - -.. code-block:: none - - firewall { - group { - network-group BAD-NETWORKS { - network 198.51.100.0/24 - network 203.0.113.0/24 - } - network-group GOOD-NETWORKS { - network 192.0.2.0/24 - } - port-group BAD-PORTS { - port 65535 - } - } - ipv4 { - forward { - filter { - default-action accept - rule 5 { - action accept - source { - group { - network-group GOOD-NETWORKS - } - } - } - rule 10 { - action drop - description "Bad Networks" - protocol all - source { - group { - network-group BAD-NETWORKS - } - } - } - } - } - } - } - -Update geoip database -===================== - -.. opcmd:: update geoip - - Command to update GeoIP database and firewall sets. diff --git a/docs/configuration/firewall/ipv6.md b/docs/configuration/firewall/ipv6.md new file mode 100644 index 00000000..e9011b4c --- /dev/null +++ b/docs/configuration/firewall/ipv6.md @@ -0,0 +1,1567 @@ +--- +lastproofread: '2026-04-01' +--- + +(firewall-ipv6-configuration)= + +# IPv6 Firewall Configuration + +## Overview + +This section covers useful information about IPv6 firewall configuration and +appropriate operation-mode commands. + +This section describes the following configuration commands: + +```{cfgcmd} set firewall ipv6 ... +``` + +To learn about the general traffic flow in VyOS firewalls, see {doc}`Firewall `. + +```none +- set firewall + * ipv6 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - name + + custom_name +``` + +The router first receives all traffic and processes it in the **prerouting** +section. + + +This stage includes: + + +- **Firewall Prerouting**: commands found under `set firewall ipv6 + prerouting raw ...` +- {doc}`Conntrack Ignore`: `set system + conntrack ignore ipv6...` +- {doc}`Policy Route`: commands found under + `set policy route6 ...` +- {doc}`Destination NAT`: commands found under + `set nat66 destination ...` + + +For transit traffic that the router receives and forwards, the base chain is +**forward**. The following diagram shows a simplified packet flow for transit +traffic: + + +:::{figure} /_static/images/firewall-fwd-packet-flow.webp +::: + + +Use `set firewall ipv6 forward filter ...` to configure filtering rules for +transit traffic. This command corresponds to stage 5 and is highlighted in red +in the diagram. + + +For traffic destined to the router, use the **input** chain. For traffic the +router generates, use the **output** chain. The following diagram shows the +packet flow for traffic destined to the router and traffic generated by the +router (starting from circle number 6): + + +:::{figure} /_static/images/firewall-input-packet-flow.webp +::: + + +Use `set firewall ipv6 input filter ...` to configure traffic destined to +the router. + + +Use `set firewall ipv6 output ...` to configure traffic the router generates. +Two sub-chains are available: **filter** and **raw**: + + +- **Output Prerouting**: `set firewall ipv6 output raw ...`. + As described in **Prerouting**, the firewall processes rules in this + section before the connection tracking subsystem. +- **Output Filter**: `set firewall ipv6 output filter ...`. The firewall + processes rules in this section after the connection tracking subsystem. + + +:::{note} +**Important note about default-actions:** +If you do not define a default action for a base chain, the system sets +the default action to **accept** for that chain. For custom chains, if you +do not define a default action, the system sets the default-action to +**drop** +::: + + +Create custom firewall chains using the commands +`set firewall ipv6 name ...`. To use the custom chain, define a +rule with **action jump** and the appropriate **target** in a base chain. + + +## Firewall - IPv6 Rules + + +Create firewall rules for firewall filtering. Each rule is numbered and has +an action to apply when the rule is matched. You can specify multiple matching +criteria. Packets go through rules from 1 - 999999, so order is crucial. The +firewall executes the action of the first matching rule. + + +### Actions + + +If you define a rule, you must define an action for it. The action tells the +firewall what to do when all criteria for that rule are met. + + +The action can be : + + +- `accept`: accept the packet. +- `continue`: continue parsing next rule. +- `drop`: drop the packet. +- `reject`: reject the packet. +- `jump`: jump to another custom chain. +- `return`: Return from the current chain and continue at the next rule + of the last chain. +- `queue`: Enqueue packet to userspace. +- `synproxy`: synproxy the packet. + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] + +This required setting defines the action of the current rule. If you set +the action to jump, you must also define a jump-target. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> jump-target \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> jump-target \ + +Use this command only when action is set to ``jump``. Specify the jump +target. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> queue \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> queue \<0-65535\> + +Use this command only when action is set to ``queue``. Specify the queue +target. Queue ranges are also supported. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> queue-options bypass +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> queue-options bypass + +Use this command only when action is set to ``queue``. This command allows +the packet to go through the firewall when no userspace software is connected +to the queue. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> queue-options fanout +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> queue-options fanout + +Use this command only when action is set to ``queue``. This command +distributes packets among multiple queues. +``` + +Also, **default-action** is an action that takes place whenever a packet does +not match any rule in its chain. For base chains, possible options for +**default-action** are **accept** or **drop**. + +```{cfgcmd} set firewall ipv6 forward filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall ipv6 input filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall ipv6 output filter default-action [accept | drop] +``` + +```{cfgcmd} set firewall ipv6 name \ default-action [accept | drop | jump | queue | reject | return] + +Set the default action of the rule-set if a packet does not match any rule +criteria. If you set default-action to ``jump``, you must also define +``default-jump-target``. For base chains, you can only set the default +action to ``accept`` or ``drop``. For custom chains, more actions are +available. +``` + +```{cfgcmd} set firewall ipv6 name \ default-jump-target \ + +To be used only when ``default-action`` is set to ``jump``. Use this +command to specify the jump target for the default rule. +``` +:::{note} +**Important note about default-actions:** +If you do not define the default action for a base chain, the system sets +the default action to **accept** for that chain. For custom chains, if you +do not define a default action, the system sets the default-action to +**drop**. +::: + + +### Firewall Logs + + +You can enable logging for each firewall rule. When enabled, you can also +define other log options. + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log + +Enable logging for matched packets. If this configuration command is not +present, logging is disabled. +``` + +```{cfgcmd} set firewall ipv6 forward filter default-log +``` + +```{cfgcmd} set firewall ipv6 input filter default-log +``` + +```{cfgcmd} set firewall ipv6 output filter default-log +``` + +```{cfgcmd} set firewall ipv6 name \ default-log + +Use this command to enable the logging of the default action on +the specified chain. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] + +Define log-level. Only applicable if rule log is enabled. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options group \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options group \<0-65535\> + +Define the log group to send messages to. Only applicable if rule log is +enabled. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options snapshot-length \<0-9000\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options snapshot-length \<0-9000\> + +Define the length of packet payload to include in a netlink message. Only +applicable when rule logging is enabled and log group is defined. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options queue-threshold \<0-65535\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options queue-threshold \<0-65535\> + +Define the number of packets to queue inside the kernel before sending them +to userspace. Only applicable when rule logging is enabled and log group is +defined. +``` + +### Firewall Description + + +For reference, you can define descriptions on every rule and custom chain. + +```{cfgcmd} set firewall ipv6 name \ description \ + +Provide a rule-set description to a custom firewall chain. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> description \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> description \ + +Provide a description for each rule. +``` + +### Rule Status + + +New rules are enabled by default. In some cases, you may want to disable a +rule rather than remove it. + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> disable +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> disable + +Command for disabling a rule but keep it in the configuration. +``` + +### Matching criteria + + +There are a lot of matching criteria against which the packet can be tested. + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> connection-status nat [destination | source] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> connection-status nat [destination | source] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> connection-status nat [destination | source] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> connection-status nat [destination | source] + +Match packets based on NAT connection status. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> connection-mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> connection-mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> connection-mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> connection-mark \<1-2147483647\> + +Match packets based on connection mark. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination address [address | addressrange | CIDR] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination address [address | addressrange | CIDR] + +Match based on source or destination address. This is similar to network +groups, but you can negate the matching addresses here. + +:::{code-block} none +set firewall ipv6 name FOO rule 100 source address 2001:db8::202 +::: +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source address-mask [address] +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination address-mask [address] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination address-mask [address] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination address-mask [address] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination address-mask [address] + +Apply an arbitrary netmask to mask addresses and match only a specific +portion. This is useful for IPv6 because rules remain valid when the IPv6 +prefix changes if the host portion of the system's IPv6 address is static. +Examples include SLAAC and tokenised IPv6 addresses + +This function works for both individual addresses and address groups. + + +:::{code-block} none +# Match any IPv6 address with the suffix ::0000:0000:0000:beef +set firewall ipv6 forward filter rule 100 destination address ::beef +set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff +# Address groups +set firewall group ipv6-address-group WEBSERVERS address ::1000 +set firewall group ipv6-address-group WEBSERVERS address ::2000 +set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS +set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff +::: +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source fqdn \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination fqdn \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination fqdn \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination fqdn \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination fqdn \ + +Specify a Fully Qualified Domain Name as source or destination to match. +Ensure that the router can resolve the DNS query. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination geoip country-code \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source geoip inverse-match +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination geoip inverse-match +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination geoip inverse-match +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination geoip inverse-match +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination geoip inverse-match + +Match IP addresses based on their geolocation. For more information, see +GeoIP matching. +Use inverse-match to match anything except the specified country codes. +``` + +DB-IP.com provides data under CC-BY-4.0 license. Attribution is required and +redistribution is permitted, allowing VyOS to include a database in images +(approximately 3 MB compressed). The package includes a cron script that you +can manually call through op-mode update geoip to keep the database and rules +updated. + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source mac-address \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source mac-address \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source mac-address \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source mac-address \ + +You can specify only a source MAC address to match. + +:::{code-block} none +set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33 +set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34 +::: +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination port [1-65535 | portname | start-end] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination port [1-65535 | portname | start-end] + +Specify a port by number or by name as defined in ``/etc/services``. + +:::{code-block} none +set firewall ipv6 forward filter rule 10 source port '22' +set firewall ipv6 forward filter rule 11 source port '!http' +set firewall ipv6 forward filter rule 12 source port 'https' +::: +Multiple source ports can be specified as a comma-separated list. +The whole list can also be "negated" using ``!``. For example: + +:::{code-block} none +set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338' +::: +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group address-group \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group address-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group address-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group address-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group address-group \ + +Specify an address group. You can prepend the character ``!`` to invert the +matching criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group dynamic-address-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group dynamic-address-group \ + +Specify a dynamic address group. You can prepend the character ``!`` to +invert the matching criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group network-group \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group network-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group network-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group network-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group network-group \ + +Specify a network group. You can prepend the character ``!`` to invert the +matching criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group port-group \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group port-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group port-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group port-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group port-group \ + +Specify a port group. You can prepend the character ``!`` to invert the +matching criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group domain-group \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group domain-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group domain-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group domain-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group domain-group \ + +Specify a domain group. You can prepend the character ``!`` to invert the +matching criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group mac-group \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group mac-group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group mac-group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group mac-group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group mac-group \ + +Specify a MAC group. You can prepend the character ``!`` to invert the +matching criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> dscp [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> dscp-exclude [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> dscp-exclude [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> dscp-exclude [0-63 | start-end] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> dscp-exclude [0-63 | start-end] + +Match based on dscp value. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> fragment [match-frag | match-non-frag] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> fragment [match-frag | match-non-frag] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> fragment [match-frag | match-non-frag] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> fragment [match-frag | match-non-frag] + +Match packets based on fragmentation. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> icmpv6 [code | type] \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> icmpv6 [code | type] \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> icmpv6 [code | type] \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> icmpv6 [code | type] \<0-255\> + +Match packets based on ICMP or ICMPv6 code and type. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> icmpv6 type-name \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> icmpv6 type-name \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> icmpv6 type-name \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> icmpv6 type-name \ + +Match based on ICMPv6 type-name. Press **Tab** for information about +supported **type-name** criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> inbound-interface name \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> inbound-interface name \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> inbound-interface name \ + +Match based on inbound interface. You can use the wildcard ``*``. For +example: ``eth2*``. You can prepend the character ``!`` to invert the +matching criteria. For example ``!eth2`` +``` +:::{note} +If an interface is attached to a non-default VRF, when using +**inbound-interface**, use the VRF name. For example: +`set firewall ipv6 forward filter rule 10 inbound-interface name MGMT` +::: +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> inbound-interface group \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> inbound-interface group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> inbound-interface group \ + +Match based on the inbound interface group. You can prepend the character +``!`` to invert the matching criteria. For example ``!IFACE_GROUP`` +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> outbound-interface name \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> outbound-interface name \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> outbound-interface name \ + +Match based on outbound interface. You can use the wildcard ``*``. For +example: ``eth2*``. You can prepend the character ``!`` to invert the +matching criteria. For example ``!eth2`` +``` +:::{note} +If an interface is attached to a non-default VRF, when using +**outbound-interface**, use the physical interface name. For example: +`set firewall ipv6 forward filter rule 10 outbound-interface name eth0` +::: +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> outbound-interface group \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> outbound-interface group \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> outbound-interface group \ + +Match based on outbound interface group. You can prepend the character ``!`` +to invert the matching criteria. For example ``!IFACE_GROUP`` +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> ipsec [match-ipsec-in | match-none-in] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> ipsec [match-ipsec-out | match-none-out] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] + +Match packets based on IPsec. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> limit burst \<0-4294967295\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> limit burst \<0-4294967295\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> limit burst \<0-4294967295\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> limit burst \<0-4294967295\> + +Match based on the maximum number of packets allowed to exceed the rate +limit. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> limit rate \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> limit rate \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> limit rate \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> limit rate \ + +Match based on the maximum average rate, specified as ``integer/unit``. +For example, specify ``5/minutes``. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> packet-length \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> packet-length-exclude \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> packet-length-exclude \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> packet-length-exclude \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> packet-length-exclude \ + +Match based on packet length. You can specify multiple values from 1 to +65535 and ranges. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> packet-type [broadcast | host | multicast | other] + +Match based on packet type. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] + +Match based on protocol number or name as defined in ``/etc/protocols``. +Specify ``all`` for all protocols and ``tcp_udp`` for TCP and UDP packets. +Prepend ``!`` to negate the protocol selection. + +:::{code-block} none +set firewall ipv6 input filter rule 10 protocol tcp +::: +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent time [second | minute | hour] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent time [second | minute | hour] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent time [second | minute | hour] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent time [second | minute | hour] + +Match packets based on recently seen sources. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> tcp flags [not] \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> tcp flags [not] \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> tcp flags [not] \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> tcp flags [not] \ + +Allowed values for TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``, +``rst``, ``syn``, and ``urg``. You can specify multiple values. To invert +the selection, use ``not``, as shown in the following example. + +:::{code-block} none +set firewall ipv6 input filter rule 10 tcp flags 'ack' +set firewall ipv6 input filter rule 12 tcp flags 'syn' +set firewall ipv6 input filter rule 13 tcp flags not 'fin' +::: +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> state [established | invalid | new | related] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> state [established | invalid | new | related] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> state [established | invalid | new | related] +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> state [established | invalid | new | related] + +Match based on packet state. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time startdate \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time starttime \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time stopdate \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time stoptime \ +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time weekdays \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time weekdays \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time weekdays \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time weekdays \ + +Match packets based on time criteria. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> hop-limit \ \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> hop-limit \ \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> hop-limit \ \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> hop-limit \ \<0-255\> + +Match the hop-limit parameter. Use ``eq`` for equal, ``gt`` for greater than, +and ``lt`` for less than. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent count \<1-255\> +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent time \ +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent time \ +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent time \ +``` + +```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent time \ + +Match when the specified number of connections occur within the specified +time period. Use these criteria to block brute-force attempts. +``` + +### Packet Modifications + + +The firewall can modify packets before sending them. +This feature provides more flexibility for packet handling. + +```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set dscp \<0-63\> +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set dscp \<0-63\> +``` + +```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set dscp \<0-63\> + +Set a specific value of Differentiated Services Codepoint (DSCP). +``` + +```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set mark \<1-2147483647\> +``` + +```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set mark \<1-2147483647\> + +Set a specific packet mark value. +``` + +```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set tcp-mss \<500-1460\> +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set tcp-mss \<500-1460\> +``` + +```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set tcp-mss \<500-1460\> + +Set the TCP-MSS (TCP maximum segment size) for the connection. +``` + +```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set hop-limit \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set hop-limit \<0-255\> +``` + +```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set hop-limit \<0-255\> + +Set hop limit value. +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set connection-mark \<0-2147483647\> +``` + +```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set connection-mark \<0-2147483647\> + +Set connection mark value. +``` + +## Synproxy + + +Synproxy connections + +```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> action synproxy +``` + +```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> protocol tcp +``` + +```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> synproxy tcp mss \<501-65535\> + + Set the TCP MSS (maximum segment size) for the connection. +``` + +```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> synproxy tcp window-scale \<1-14\> + + Set the window scale factor for TCP window scaling. +``` + +### Example synproxy + + +Requirements to enable synproxy: + + +- Traffic must be symmetric +- Synproxy relies on syncookies and TCP timestamps, ensure these are enabled +- Disable conntrack loose track option + +```none +set system sysctl parameter net.ipv4.tcp_timestamps value '1' + + +set system conntrack tcp loose disable + +set system conntrack ignore ipv6 rule 10 destination port '8080' + +set system conntrack ignore ipv6 rule 10 protocol 'tcp' + +set system conntrack ignore ipv6 rule 10 tcp flags syn + + +set firewall global-options syn-cookies 'enable' + +set firewall ipv6 input filter rule 10 action 'synproxy' + +set firewall ipv6 input filter rule 10 destination port '8080' + +set firewall ipv6 input filter rule 10 inbound-interface name 'eth1' + +set firewall ipv6 input filter rule 10 protocol 'tcp' + +set firewall ipv6 input filter rule 10 synproxy tcp mss '1460' + +set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7' + +set firewall ipv6 input filter rule 1000 action 'drop' + +set firewall ipv6 input filter rule 1000 state invalid + +``` + +## Operation-mode Firewall + + +### Rule-set overview + +```{opcmd} show firewall + +Show a basic firewall overview for all rule-sets, not only for IPv6: + +:::{code-block} none +vyos@vyos:~$ show firewall +Rulesets Information + +--------------------------------- +IPv4 Firewall "forward filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ----------------------------------------- +5 jump all 0 0 iifname "eth1" jump NAME_VyOS_MANAGEMENT +10 jump all 0 0 oifname "eth1" jump NAME_WAN_IN +15 jump all 0 0 iifname "eth3" jump NAME_WAN_IN +default accept all + +--------------------------------- +IPv4 Firewall "name VyOS_MANAGEMENT" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- -------------------------------- +5 accept all 0 0 ct state established accept +10 drop all 0 0 ct state invalid +20 accept all 0 0 ip saddr @A_GOOD_GUYS accept +30 accept all 0 0 ip saddr @N_ENTIRE_RANGE accept +40 accept all 0 0 ip saddr @A_VyOS_SERVERS accept +50 accept icmp 0 0 meta l4proto icmp accept +default drop all 0 0 + +--------------------------------- +IPv6 Firewall "forward filter" + +Rule Action Protocol +------- -------- ---------- +5 jump all +10 jump all +15 jump all +default accept all + +--------------------------------- +IPv6 Firewall "input filter" + +Rule Action Protocol +------- -------- ---------- +5 jump all +default accept all + +--------------------------------- +IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT" + +Rule Action Protocol +------- -------- ---------- +5 accept all +10 drop all +20 accept all +30 accept all +40 accept all +50 accept ipv6-icmp +default drop all +::: +``` + +```{opcmd} show firewall summary + +This will show you a summary of rule-sets and groups + +:::{code-block} none +vyos@vyos:~$ show firewall summary +Ruleset Summary + +IPv6 Ruleset: + +Ruleset Hook Ruleset Priority Description +-------------- -------------------- ------------------------- +forward filter +input filter +ipv6_name IPV6-VyOS_MANAGEMENT +ipv6_name IPV6-WAN_IN PUBLIC_INTERNET + +IPv4 Ruleset: + +Ruleset Hook Ruleset Priority Description +-------------- ------------------ ------------------------- +forward filter +input filter +name VyOS_MANAGEMENT +name WAN_IN PUBLIC_INTERNET + +Firewall Groups + +Name Type References Members +----------------------- ------------------ ----------------------- ---------------- +PBX address_group WAN_IN-100 198.51.100.77 +SERVERS address_group WAN_IN-110 192.0.2.10 +WAN_IN-111 192.0.2.11 +WAN_IN-112 192.0.2.12 +WAN_IN-120 +WAN_IN-121 +WAN_IN-122 +SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 +WAN_IN-20 +PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 +PINGABLE_ADDRESSES address_group WAN_IN-170 192.168.5.2 +WAN_IN-171 +PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 +SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 +IPV6-WAN_IN-111 2001:db8::3 +IPV6-WAN_IN-112 2001:db8::4 +IPV6-WAN_IN-120 +IPV6-WAN_IN-121 +IPV6-WAN_IN-122 +SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 +IPV6-WAN_IN-20 +::: +``` + +```{opcmd} show firewall ipv6 [forward | input | output] filter +``` + +```{opcmd} show firewall ipv6 ipv6-name \ + +This command will give an overview of a single rule-set. + +:::{code-block} none +vyos@vyos:~$ show firewall ipv6 input filter +Ruleset Information + +--------------------------------- +ipv6 Firewall "input filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ------------------------------------------------------------------------------ +10 jump all 13 1456 iifname "eth1" jump NAME6_INP-ETH1 +20 accept ipv6-icmp 10 1112 meta l4proto ipv6-icmp iifname "eth0" prefix "[ipv6-INP-filter-20-A]" accept +default accept all 14 1584 + +vyos@vyos:~$ +::: +``` + +```{opcmd} show firewall ipv6 [forward | input | output] filter rule \<1-999999\> +``` + +```{opcmd} show firewall ipv6 name \ rule \<1-999999\> +``` + +```{opcmd} show firewall ipv6 ipv6-name \ rule \<1-999999\> + +This command will give an overview of a rule in a single rule-set +``` + +```{opcmd} show firewall group \ + +Show an overview of defined groups, including the type, members, and where +the group is used. + +:::{code-block} none +vyos@vyos:~$ show firewall group LAN +Firewall Groups + +Name Type References Members +------------ ------------------ ----------------------- ---------------- +LAN ipv6_network_group IPV6-VyOS_MANAGEMENT-30 2001:db8::0/64 +IPV6-WAN_IN-30 +LAN network_group VyOS_MANAGEMENT-30 192.168.200.0/24 +WAN_IN-30 +::: +``` + +```{opcmd} show firewall statistics + +Show statistics of all rule-sets since the last boot. +``` + +### Show Firewall log + +```{opcmd} show log firewall +``` + +```{opcmd} show log firewall ipv6 +``` + +```{opcmd} show log firewall ipv6 [forward | input | output | name] +``` + +```{opcmd} show log firewall ipv6 [forward | input | output] filter +``` + +```{opcmd} show log firewall ipv6 name \ +``` + +```{opcmd} show log firewall ipv6 [forward | input | output] filter rule \ +``` + +```{opcmd} show log firewall ipv6 name \ rule \ + +Show firewall logs for all firewalls, all IPv6 firewalls, specific hooks, +specific priorities, specific custom chains, or specific rule-sets. +``` + +### Example Partial Config + +```none +firewall { + ipv6 { + input { + filter { + rule 10 { + action jump + inbound-interface { + name eth1 + } + jump-target INP-ETH1 + } + rule 20 { + action accept + inbound-interface { + name eth0 + } + log + protocol ipv6-icmp + } + } + } + name INP-ETH1 { + default-action drop + default-log + rule 10 { + action accept + protocol tcp_udp + } + } + } +} +``` + +### Update geoip database + +```{opcmd} update geoip + +Command used to update GeoIP database and firewall sets. +``` \ No newline at end of file diff --git a/docs/configuration/firewall/ipv6.rst b/docs/configuration/firewall/ipv6.rst deleted file mode 100644 index d31ceb6f..00000000 --- a/docs/configuration/firewall/ipv6.rst +++ /dev/null @@ -1,1302 +0,0 @@ -:lastproofread: 2026-04-01 - -.. _firewall-ipv6-configuration: - -########################### -IPv6 Firewall Configuration -########################### - -******** -Overview -******** - -This section covers useful information about IPv6 firewall configuration and -appropriate operation-mode commands. - -This section describes the following configuration commands: - -.. cfgcmd:: set firewall ipv6 ... - -To learn about the general traffic flow in VyOS firewalls, -see :doc:`Firewall `. - -.. code-block:: none - - - set firewall - * ipv6 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name - -The router first receives all traffic and processes it in the **prerouting** -section. - -This stage includes: - - * **Firewall Prerouting**: commands found under ``set firewall ipv6 - prerouting raw ...`` - * :doc:`Conntrack Ignore`: ``set system - conntrack ignore ipv6...`` - * :doc:`Policy Route`: commands found under - ``set policy route6 ...`` - * :doc:`Destination NAT`: commands found under - ``set nat66 destination ...`` - -For transit traffic that the router receives and forwards, the base chain is -**forward**. The following diagram shows a simplified packet flow for transit -traffic: - -.. figure:: /_static/images/firewall-fwd-packet-flow.* - -Use ``set firewall ipv6 forward filter ...`` to configure filtering rules for -transit traffic. This command corresponds to stage 5 and is highlighted in red -in the diagram. - -For traffic destined to the router, use the **input** chain. For traffic the -router generates, use the **output** chain. The following diagram shows the -packet flow for traffic destined to the router and traffic generated by the -router (starting from circle number 6): - -.. figure:: /_static/images/firewall-input-packet-flow.* - -Use ``set firewall ipv6 input filter ...`` to configure traffic destined to -the router. - -Use ``set firewall ipv6 output ...`` to configure traffic the router generates. -Two sub-chains are available: **filter** and **raw**: - -* **Output Prerouting**: ``set firewall ipv6 output raw ...``. - As described in **Prerouting**, the firewall processes rules in this - section before the connection tracking subsystem. -* **Output Filter**: ``set firewall ipv6 output filter ...``. The firewall - processes rules in this section after the connection tracking subsystem. - -.. note:: **Important note about default-actions:** - If you do not define a default action for a base chain, the system sets - the default action to **accept** for that chain. For custom chains, if you - do not define a default action, the system sets the default-action to - **drop** - -Create custom firewall chains using the commands -``set firewall ipv6 name ...``. To use the custom chain, define a -rule with **action jump** and the appropriate **target** in a base chain. - -****************************** -Firewall - IPv6 Rules -****************************** - -Create firewall rules for firewall filtering. Each rule is numbered and has -an action to apply when the rule is matched. You can specify multiple matching -criteria. Packets go through rules from 1 - 999999, so order is crucial. The -firewall executes the action of the first matching rule. - -Actions -======= - -If you define a rule, you must define an action for it. The action tells the -firewall what to do when all criteria for that rule are met. - -The action can be : - - * ``accept``: accept the packet. - - * ``continue``: continue parsing next rule. - - * ``drop``: drop the packet. - - * ``reject``: reject the packet. - - * ``jump``: jump to another custom chain. - - * ``return``: Return from the current chain and continue at the next rule - of the last chain. - - * ``queue``: Enqueue packet to userspace. - - * ``synproxy``: synproxy the packet. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] - - This required setting defines the action of the current rule. If you set - the action to jump, you must also define a jump-target. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - jump-target -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - jump-target - - Use this command only when action is set to ``jump``. Specify the jump - target. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - queue <0-65535> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - queue <0-65535> - - Use this command only when action is set to ``queue``. Specify the queue - target. Queue ranges are also supported. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - queue-options bypass -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - queue-options bypass - - Use this command only when action is set to ``queue``. This command allows - the packet to go through the firewall when no userspace software is connected - to the queue. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - queue-options fanout -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - queue-options fanout - - Use this command only when action is set to ``queue``. This command - distributes packets among multiple queues. - -Also, **default-action** is an action that takes place whenever a packet does -not match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -.. cfgcmd:: set firewall ipv6 forward filter default-action - [accept | drop] -.. cfgcmd:: set firewall ipv6 input filter default-action - [accept | drop] -.. cfgcmd:: set firewall ipv6 output filter default-action - [accept | drop] -.. cfgcmd:: set firewall ipv6 name default-action - [accept | drop | jump | queue | reject | return] - - Set the default action of the rule-set if a packet does not match any rule - criteria. If you set default-action to ``jump``, you must also define - ``default-jump-target``. For base chains, you can only set the default - action to ``accept`` or ``drop``. For custom chains, more actions are - available. - -.. cfgcmd:: set firewall ipv6 name default-jump-target - - To be used only when ``default-action`` is set to ``jump``. Use this - command to specify the jump target for the default rule. - -.. note:: **Important note about default-actions:** - If you do not define the default action for a base chain, the system sets - the default action to **accept** for that chain. For custom chains, if you - do not define a default action, the system sets the default-action to - **drop**. - -Firewall Logs -============= - -You can enable logging for each firewall rule. When enabled, you can also -define other log options. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> log -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> log -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> log -.. cfgcmd:: set firewall ipv6 name rule <1-999999> log - - Enable logging for matched packets. If this configuration command is not - present, logging is disabled. - -.. cfgcmd:: set firewall ipv6 forward filter default-log -.. cfgcmd:: set firewall ipv6 input filter default-log -.. cfgcmd:: set firewall ipv6 output filter default-log -.. cfgcmd:: set firewall ipv6 name default-log - - Use this command to enable the logging of the default action on - the specified chain. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] - - Define log-level. Only applicable if rule log is enabled. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options group <0-65535> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options group <0-65535> - - Define the log group to send messages to. Only applicable if rule log is - enabled. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options snapshot-length <0-9000> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options snapshot-length <0-9000> - - Define the length of packet payload to include in a netlink message. Only - applicable when rule logging is enabled and log group is defined. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options queue-threshold <0-65535> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options queue-threshold <0-65535> - - Define the number of packets to queue inside the kernel before sending them - to userspace. Only applicable when rule logging is enabled and log group is - defined. - -Firewall Description -==================== - -For reference, you can define descriptions on every rule and custom chain. - -.. cfgcmd:: set firewall ipv6 name description - - Provide a rule-set description to a custom firewall chain. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - description -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - description -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - description -.. cfgcmd:: set firewall ipv6 name rule <1-999999> description - - Provide a description for each rule. - -Rule Status -=========== - -New rules are enabled by default. In some cases, you may want to disable a -rule rather than remove it. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> disable -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> disable -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> disable -.. cfgcmd:: set firewall ipv6 name rule <1-999999> disable - - Command for disabling a rule but keep it in the configuration. - -Matching criteria -================= - -There are a lot of matching criteria against which the packet can be tested. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - connection-status nat [destination | source] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - connection-status nat [destination | source] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - connection-status nat [destination | source] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - connection-status nat [destination | source] - - Match packets based on NAT connection status. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - connection-mark <1-2147483647> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - connection-mark <1-2147483647> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - connection-mark <1-2147483647> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - connection-mark <1-2147483647> - - Match packets based on connection mark. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source address [address | addressrange | CIDR] - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination address [address | addressrange | CIDR] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination address [address | addressrange | CIDR] - - Match based on source or destination address. This is similar to network - groups, but you can negate the matching addresses here. - - .. code-block:: none - - set firewall ipv6 name FOO rule 100 source address 2001:db8::202 - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source address-mask [address] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source address-mask [address] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source address-mask [address] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source address-mask [address] - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination address-mask [address] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination address-mask [address] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination address-mask [address] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination address-mask [address] - - Apply an arbitrary netmask to mask addresses and match only a specific - portion. This is useful for IPv6 because rules remain valid when the IPv6 - prefix changes if the host portion of the system's IPv6 address is static. - Examples include SLAAC and `tokenised IPv6 addresses - `_ - - This function works for both individual addresses and address groups. - - .. stop_vyoslinter - .. code-block:: none - - # Match any IPv6 address with the suffix ::0000:0000:0000:beef - set firewall ipv6 forward filter rule 100 destination address ::beef - set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff - # Address groups - set firewall group ipv6-address-group WEBSERVERS address ::1000 - set firewall group ipv6-address-group WEBSERVERS address ::2000 - set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS - set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff - - .. start_vyoslinter - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source fqdn -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination fqdn -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination fqdn -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination fqdn -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination fqdn - - Specify a Fully Qualified Domain Name as source or destination to match. - Ensure that the router can resolve the DNS query. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source geoip country-code -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source geoip country-code -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source geoip country-code -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source geoip country-code - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination geoip country-code -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination geoip country-code -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination geoip country-code -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination geoip country-code - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source geoip inverse-match -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source geoip inverse-match -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source geoip inverse-match -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source geoip inverse-match - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination geoip inverse-match -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination geoip inverse-match -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination geoip inverse-match -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination geoip inverse-match - - Match IP addresses based on their geolocation. For more information, see - `GeoIP matching `_. Use inverse-match to match anything except the specified - country codes. - -DB-IP.com provides data under CC-BY-4.0 license. Attribution is required and -redistribution is permitted, allowing VyOS to include a database in images -(approximately 3 MB compressed). The package includes a cron script that you -can manually call through op-mode update geoip to keep the database and rules -updated. - - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source mac-address -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source mac-address -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source mac-address -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source mac-address - - You can specify only a source MAC address to match. - - .. code-block:: none - - set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33 - set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34 - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source port [1-65535 | portname | start-end] - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination port [1-65535 | portname | start-end] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination port [1-65535 | portname | start-end] - - Specify a port by number or by name as defined in ``/etc/services``. - - .. code-block:: none - - set firewall ipv6 forward filter rule 10 source port '22' - set firewall ipv6 forward filter rule 11 source port '!http' - set firewall ipv6 forward filter rule 12 source port 'https' - - Multiple source ports can be specified as a comma-separated list. - The whole list can also be "negated" using ``!``. For example: - - .. code-block:: none - - set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338' - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group address-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group address-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group address-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group address-group - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group address-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group address-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group address-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group address-group - - Specify an address group. You can prepend the character ``!`` to invert the - matching criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group dynamic-address-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group dynamic-address-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group dynamic-address-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group dynamic-address-group - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group dynamic-address-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group dynamic-address-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group dynamic-address-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group dynamic-address-group - - Specify a dynamic address group. You can prepend the character ``!`` to - invert the matching criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group network-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group network-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group network-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group network-group - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group network-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group network-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group network-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group network-group - - Specify a network group. You can prepend the character ``!`` to invert the - matching criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group port-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group port-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group port-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group port-group - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group port-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group port-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group port-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group port-group - - Specify a port group. You can prepend the character ``!`` to invert the - matching criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group domain-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group domain-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group domain-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group domain-group - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group domain-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group domain-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group domain-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group domain-group - - Specify a domain group. You can prepend the character ``!`` to invert the - matching criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group mac-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group mac-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group mac-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group mac-group - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group mac-group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group mac-group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group mac-group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group mac-group - - Specify a MAC group. You can prepend the character ``!`` to invert the - matching criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - dscp [0-63 | start-end] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - dscp [0-63 | start-end] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - dscp [0-63 | start-end] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - dscp [0-63 | start-end] - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - dscp-exclude [0-63 | start-end] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - dscp-exclude [0-63 | start-end] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - dscp-exclude [0-63 | start-end] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - dscp-exclude [0-63 | start-end] - - Match based on dscp value. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - fragment [match-frag | match-non-frag] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - fragment [match-frag | match-non-frag] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - fragment [match-frag | match-non-frag] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - fragment [match-frag | match-non-frag] - - Match packets based on fragmentation. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - icmpv6 [code | type] <0-255> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - icmpv6 [code | type] <0-255> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - icmpv6 [code | type] <0-255> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - icmpv6 [code | type] <0-255> - - Match packets based on ICMP or ICMPv6 code and type. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - icmpv6 type-name -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - icmpv6 type-name -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - icmpv6 type-name -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - icmpv6 type-name - - Match based on ICMPv6 type-name. Press **Tab** for information about - supported **type-name** criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - inbound-interface name -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - inbound-interface name -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - inbound-interface name - - Match based on inbound interface. You can use the wildcard ``*``. For - example: ``eth2*``. You can prepend the character ``!`` to invert the - matching criteria. For example ``!eth2`` - -.. note:: If an interface is attached to a non-default VRF, when using - **inbound-interface**, use the VRF name. For example: - ``set firewall ipv6 forward filter rule 10 inbound-interface name MGMT`` - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - inbound-interface group -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - inbound-interface group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - inbound-interface group - - Match based on the inbound interface group. You can prepend the character - ``!`` to invert the matching criteria. For example ``!IFACE_GROUP`` - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - outbound-interface name -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - outbound-interface name -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - outbound-interface name - - Match based on outbound interface. You can use the wildcard ``*``. For - example: ``eth2*``. You can prepend the character ``!`` to invert the - matching criteria. For example ``!eth2`` - -.. note:: If an interface is attached to a non-default VRF, when using - **outbound-interface**, use the physical interface name. For example: - ``set firewall ipv6 forward filter rule 10 outbound-interface name eth0`` - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - outbound-interface group -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - outbound-interface group -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - outbound-interface group - - Match based on outbound interface group. You can prepend the character ``!`` - to invert the matching criteria. For example ``!IFACE_GROUP`` - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - ipsec [match-ipsec-in | match-none-in] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - ipsec [match-ipsec-out | match-none-out] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] - - Match packets based on IPsec. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - limit burst <0-4294967295> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - limit burst <0-4294967295> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - limit burst <0-4294967295> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - limit burst <0-4294967295> - - Match based on the maximum number of packets allowed to exceed the rate - limit. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - limit rate -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - limit rate -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - limit rate -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - limit rate - - Match based on the maximum average rate, specified as ``integer/unit``. - For example, specify ``5/minutes``. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - packet-length -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - packet-length -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - packet-length -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - packet-length - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - packet-length-exclude -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - packet-length-exclude -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - packet-length-exclude -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - packet-length-exclude - - Match based on packet length. You can specify multiple values from 1 to - 65535 and ranges. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - packet-type [broadcast | host | multicast | other] - - Match based on packet type. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] - - Match based on protocol number or name as defined in ``/etc/protocols``. - Specify ``all`` for all protocols and ``tcp_udp`` for TCP and UDP packets. - Prepend ``!`` to negate the protocol selection. - - .. code-block:: none - - set firewall ipv6 input filter rule 10 protocol tcp - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent count <1-255> - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent time [second | minute | hour] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent time [second | minute | hour] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent time [second | minute | hour] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent time [second | minute | hour] - - Match packets based on recently seen sources. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - tcp flags [not] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - tcp flags [not] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - tcp flags [not] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - tcp flags [not] - - Allowed values for TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``, - ``rst``, ``syn``, and ``urg``. You can specify multiple values. To invert - the selection, use ``not``, as shown in the following example. - - .. code-block:: none - - set firewall ipv6 input filter rule 10 tcp flags 'ack' - set firewall ipv6 input filter rule 12 tcp flags 'syn' - set firewall ipv6 input filter rule 13 tcp flags not 'fin' - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - state [established | invalid | new | related] -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - state [established | invalid | new | related] -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - state [established | invalid | new | related] -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - state [established | invalid | new | related] - - Match based on packet state. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time startdate -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time starttime -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time stopdate -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time stoptime -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time weekdays -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time weekdays -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time weekdays -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time weekdays - - Match packets based on time criteria. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - hop-limit <0-255> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - hop-limit <0-255> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - hop-limit <0-255> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - hop-limit <0-255> - - Match the hop-limit parameter. Use ``eq`` for equal, ``gt`` for greater than, - and ``lt`` for less than. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent count <1-255> -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent count <1-255> - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent time -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent time -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent time -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent time - - Match when the specified number of connections occur within the specified - time period. Use these criteria to block brute-force attempts. - -Packet Modifications -==================== - -The firewall can modify packets before sending them. -This feature provides more flexibility for packet handling. - -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set dscp <0-63> -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set dscp <0-63> -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set dscp <0-63> - - Set a specific value of Differentiated Services Codepoint (DSCP). - -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set mark <1-2147483647> -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set mark <1-2147483647> -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set mark <1-2147483647> - - Set a specific packet mark value. - -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set tcp-mss <500-1460> -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set tcp-mss <500-1460> -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set tcp-mss <500-1460> - - Set the TCP-MSS (TCP maximum segment size) for the connection. - -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set hop-limit <0-255> -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set hop-limit <0-255> -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set hop-limit <0-255> - - Set hop limit value. - -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set connection-mark <0-2147483647> -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set connection-mark <0-2147483647> - - Set connection mark value. - -******** -Synproxy -******** -Synproxy connections - -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - action synproxy -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - protocol tcp -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - synproxy tcp mss <501-65535> - - Set the TCP MSS (maximum segment size) for the connection. - -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - synproxy tcp window-scale <1-14> - - Set the window scale factor for TCP window scaling. - -Example synproxy -================ -Requirements to enable synproxy: - - * Traffic must be symmetric - * Synproxy relies on syncookies and TCP timestamps, ensure these are enabled - * Disable conntrack loose track option - -.. code-block:: none - - set system sysctl parameter net.ipv4.tcp_timestamps value '1' - - set system conntrack tcp loose disable - set system conntrack ignore ipv6 rule 10 destination port '8080' - set system conntrack ignore ipv6 rule 10 protocol 'tcp' - set system conntrack ignore ipv6 rule 10 tcp flags syn - - set firewall global-options syn-cookies 'enable' - set firewall ipv6 input filter rule 10 action 'synproxy' - set firewall ipv6 input filter rule 10 destination port '8080' - set firewall ipv6 input filter rule 10 inbound-interface name 'eth1' - set firewall ipv6 input filter rule 10 protocol 'tcp' - set firewall ipv6 input filter rule 10 synproxy tcp mss '1460' - set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7' - set firewall ipv6 input filter rule 1000 action 'drop' - set firewall ipv6 input filter rule 1000 state invalid - -*********************** -Operation-mode Firewall -*********************** - -Rule-set overview -================= - -.. opcmd:: show firewall - - Show a basic firewall overview for all rule-sets, not only for IPv6: - - .. code-block:: none - - vyos@vyos:~$ show firewall - Rulesets Information - - --------------------------------- - IPv4 Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------------------- - 5 jump all 0 0 iifname "eth1" jump NAME_VyOS_MANAGEMENT - 10 jump all 0 0 oifname "eth1" jump NAME_WAN_IN - 15 jump all 0 0 iifname "eth3" jump NAME_WAN_IN - default accept all - - --------------------------------- - IPv4 Firewall "name VyOS_MANAGEMENT" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- -------------------------------- - 5 accept all 0 0 ct state established accept - 10 drop all 0 0 ct state invalid - 20 accept all 0 0 ip saddr @A_GOOD_GUYS accept - 30 accept all 0 0 ip saddr @N_ENTIRE_RANGE accept - 40 accept all 0 0 ip saddr @A_VyOS_SERVERS accept - 50 accept icmp 0 0 meta l4proto icmp accept - default drop all 0 0 - - --------------------------------- - IPv6 Firewall "forward filter" - - Rule Action Protocol - ------- -------- ---------- - 5 jump all - 10 jump all - 15 jump all - default accept all - - --------------------------------- - IPv6 Firewall "input filter" - - Rule Action Protocol - ------- -------- ---------- - 5 jump all - default accept all - - --------------------------------- - IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT" - - Rule Action Protocol - ------- -------- ---------- - 5 accept all - 10 drop all - 20 accept all - 30 accept all - 40 accept all - 50 accept ipv6-icmp - default drop all - -.. opcmd:: show firewall summary - - This will show you a summary of rule-sets and groups - - .. code-block:: none - - vyos@vyos:~$ show firewall summary - Ruleset Summary - - IPv6 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- -------------------- ------------------------- - forward filter - input filter - ipv6_name IPV6-VyOS_MANAGEMENT - ipv6_name IPV6-WAN_IN PUBLIC_INTERNET - - IPv4 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- ------------------ ------------------------- - forward filter - input filter - name VyOS_MANAGEMENT - name WAN_IN PUBLIC_INTERNET - - Firewall Groups - - Name Type References Members - ----------------------- ------------------ ----------------------- ---------------- - PBX address_group WAN_IN-100 198.51.100.77 - SERVERS address_group WAN_IN-110 192.0.2.10 - WAN_IN-111 192.0.2.11 - WAN_IN-112 192.0.2.12 - WAN_IN-120 - WAN_IN-121 - WAN_IN-122 - SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 - WAN_IN-20 - PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 - PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2 - WAN_IN-171 - PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 - SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 - IPV6-WAN_IN-111 2001:db8::3 - IPV6-WAN_IN-112 2001:db8::4 - IPV6-WAN_IN-120 - IPV6-WAN_IN-121 - IPV6-WAN_IN-122 - SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 - IPV6-WAN_IN-20 - - -.. opcmd:: show firewall ipv6 [forward | input | output] filter - -.. opcmd:: show firewall ipv6 ipv6-name - - This command will give an overview of a single rule-set. - - .. code-block:: none - - vyos@vyos:~$ show firewall ipv6 input filter - Ruleset Information - - --------------------------------- - ipv6 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------------------------------------------------------------ - 10 jump all 13 1456 iifname "eth1" jump NAME6_INP-ETH1 - 20 accept ipv6-icmp 10 1112 meta l4proto ipv6-icmp iifname "eth0" prefix "[ipv6-INP-filter-20-A]" accept - default accept all 14 1584 - - vyos@vyos:~$ - -.. opcmd:: show firewall ipv6 [forward | input | output] - filter rule <1-999999> - -.. opcmd:: show firewall ipv6 name rule <1-999999> - -.. opcmd:: show firewall ipv6 ipv6-name rule <1-999999> - - This command will give an overview of a rule in a single rule-set - -.. opcmd:: show firewall group - - Show an overview of defined groups, including the type, members, and where - the group is used. - - .. code-block:: none - - vyos@vyos:~$ show firewall group LAN - Firewall Groups - - Name Type References Members - ------------ ------------------ ----------------------- ---------------- - LAN ipv6_network_group IPV6-VyOS_MANAGEMENT-30 2001:db8::0/64 - IPV6-WAN_IN-30 - LAN network_group VyOS_MANAGEMENT-30 192.168.200.0/24 - WAN_IN-30 - - -.. opcmd:: show firewall statistics - - Show statistics of all rule-sets since the last boot. - -Show Firewall log -================= - -.. opcmd:: show log firewall -.. opcmd:: show log firewall ipv6 -.. opcmd:: show log firewall ipv6 [forward | input | output | name] -.. opcmd:: show log firewall ipv6 [forward | input | output] filter -.. opcmd:: show log firewall ipv6 name -.. opcmd:: show log firewall ipv6 [forward | input | output] filter rule -.. opcmd:: show log firewall ipv6 name rule - - Show firewall logs for all firewalls, all IPv6 firewalls, specific hooks, - specific priorities, specific custom chains, or specific rule-sets. - -Example Partial Config -====================== - -.. code-block:: none - - firewall { - ipv6 { - input { - filter { - rule 10 { - action jump - inbound-interface { - name eth1 - } - jump-target INP-ETH1 - } - rule 20 { - action accept - inbound-interface { - name eth0 - } - log - protocol ipv6-icmp - } - } - } - name INP-ETH1 { - default-action drop - default-log - rule 10 { - action accept - protocol tcp_udp - } - } - } - } - - -Update geoip database -===================== - -.. opcmd:: update geoip - - Command used to update GeoIP database and firewall sets. diff --git a/docs/configuration/firewall/md-bridge.md b/docs/configuration/firewall/md-bridge.md deleted file mode 100644 index f0e94f9e..00000000 --- a/docs/configuration/firewall/md-bridge.md +++ /dev/null @@ -1,685 +0,0 @@ ---- -lastproofread: '2026-03-28' ---- - -(firewall-configuration)= - -# Bridge Firewall Configuration - -## Overview - -Learn more about bridge firewall configuration -and related op-mode commands. - -The following commands are covered in this section: - -```{cfgcmd} set firewall bridge \ -``` - -From the main structure defined in -{doc}`Firewall Overview` -in this section you can find detailed information only for the next part -of the general structure: - -```none -- set firewall - * bridge - - forward - + filter - - input - + filter - - output - + filter - - prerouting - + filter - - name - + custom_name -``` - -Traffic that is received by the router on an interface that is a member of a -bridge is processed on the **Bridge Layer**. Before the bridge decision is -made, all packets are analyzed at **Prerouting**. First filters can be applied -here, and also rules for ignoring connection tracking system can be configured. -The relevant configuration that acts in **prerouting** is: - - -- `set firewall bridge prerouting filter ...`. - - -For traffic that needs to be switched internally by the bridge, the base -chain is **forward**, and its base command for filtering is `set firewall -bridge forward filter ...`, which happens in stage 4, highlighted with red -color. - - -:::{figure} /_static/images/firewall-bridge-forward.webp -::: - - -For traffic destined to the router itself or that needs to be routed -(assuming a layer3 bridge is configured), the base chain is **input**, and the -base command is `set firewall bridge input filter ...` and the path is: - - -:::{figure} /_static/images/firewall-bridge-input.webp -::: - - -If it's not dropped, then the packet is sent to **IP Layer**, and will be -processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again -the {doc}`general packet flow diagram` if -needed. - - -For traffic that originates from the bridge itself, the base chain is -**output**, and the base command is `set firewall bridge output filter -...`, and the path is: - - -:::{figure} /_static/images/firewall-bridge-output.webp -::: - - -Custom bridge firewall chains can be created with the command `set firewall -bridge name ...`. To use such a custom chain, a rule with action jump -and the appropriate target must be defined in a base chain. - - -## Bridge Rules - - -For firewall filtering, firewall rules need to be created. Each rule is -numbered, has an action to apply if the rule is matched, and the ability -to specify multiple matching criteria. Data packets go through the rules -from 1 - 999999, so order is crucial. At the first match the action of the -rule will be executed. - - -### Actions - - -If a rule is defined, an action must also be defined for it. This tells the -firewall what to do if all matching criteria in the rule are met. - - -In firewall bridge rules, the action can be: - - -- `accept`: accept the packet. -- `continue`: continue parsing next rule. -- `drop`: drop the packet. -- `jump`: jump to another custom chain. -- `return`: Return from the current chain and continue at the next rule - of the last chain. -- `queue`: Enqueue packet to userspace. -- `notrack`: ignore connection tracking system. This action is only - available in prerouting chain. - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> action [accept | continue | drop | jump | queue | return] -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> action [accept | continue | drop | jump | queue | return] -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> action [accept | continue | drop | jump | queue | return] -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> action [accept | continue | drop | jump | notrack | queue | return] -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> action [accept | continue | drop | jump | queue | return] - -This required setting defines the action of the current rule. If action is -set to jump, then jump-target is also needed. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> jump-target \ -``` - -If action is set to ``queue``, use next command to specify the queue -target. Range is also supported: - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> queue \<0-65535\> - -Also, if action is set to ``queue``, use next command to specify the queue -options. Possible options are ``bypass`` and ``fanout``: -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> queue-options fanout -``` - -Also, **default-action** is an action that takes place whenever a packet does -not match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -```{cfgcmd} set firewall bridge forward filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall bridge input filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall bridge output filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall bridge prerouting filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall bridge name \ default-action [accept | continue | drop | jump | reject | return] - -This sets the default action of the rule-set if a packet does not match -any of the rules in that chain. If default-action is set to ``jump``, then -``default-jump-target`` is also needed. Note that for base chains, default -action can only be set to ``accept`` or ``drop``, while on custom chains -more actions are available. -``` - -```{cfgcmd} set firewall bridge name \ default-jump-target \ - -To be used only when ``default-action`` is set to ``jump``. Use this -command to specify jump target for default rule. -``` -:::{note} -**Important note about default-actions:** -If the default action for any base chain is not defined, then the default -action is set to **accept** for that chain. For custom chains, if the -default action is not defined, then the default-action is set to **drop**. -::: - - -### Firewall Logs - - -You can enable logging for every firewall rule. If enabled, other log options -can be configured. - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log - -Enable logging for the matched packet. If this configuration command is not -present, then the log is not enabled. -``` - -```{cfgcmd} set firewall bridge forward filter default-log -``` - -```{cfgcmd} set firewall bridge input filter default-log -``` - -```{cfgcmd} set firewall bridge output filter default-log -``` - -```{cfgcmd} set firewall bridge prerouting filter default-log -``` - -```{cfgcmd} set firewall bridge name \ default-log - -Use this command to enable the logging of the default action on -the specified chain. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] - -Define log-level. Only applicable if rule log is enabled. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options group \<0-65535\> - -Define the log group to send messages to. Only applicable if rule log is -enabled. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options snapshot-length \<0-9000\> - -Define length of packet payload to include in netlink message. Only -applicable if rule log is enabled and the log group is defined. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> log-options queue-threshold \<0-65535\> - -Define the number of packets to queue inside the kernel before sending them -to userspace. Only applicable if rule log is enabled and the log group is -defined. -``` - -### Firewall Description - - -You can define a description for reference for every custom chain. - -```{cfgcmd} set firewall bridge name \ description \ - -Provide a rule-set description to a custom firewall chain. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> description \ - -Provide a description for each rule. -``` - -### Rule Status - - -By default, when you define a rule, it is enabled. In some cases, it is -useful to disable the rule instead of removing it. - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> disable - -Command for disabling a rule but keep it in the configuration. -``` - -### Matching criteria - - -There are many matching criteria against which a packet can be tested. Refer -to {doc}`IPv4` and -{doc}`IPv6` matching criteria for more details. - - -Since bridges operate at layer 2, both matchers for IPv4 and IPv6 are -supported in bridge firewall configuration. Same applies to firewall groups. - - -Same specific matching criteria that can be used in bridge firewall are -described in this section: - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] - -Match based on the Ethernet type of the packet. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> vlan ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] - -Match based on the Ethernet type of the packet when it is VLAN tagged. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> vlan id \<0-4096\> -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> vlan id \<0-4096\> -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> vlan id \<0-4096\> -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> vlan id \<0-4096\> -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> vlan id \<0-4096\> - -Match based on VLAN identifier. Range is also supported. -``` - -```{cfgcmd} set firewall bridge forward filter rule \<1-999999\> vlan priority \<0-7\> -``` - -```{cfgcmd} set firewall bridge input filter rule \<1-999999\> vlan priority \<0-7\> -``` - -```{cfgcmd} set firewall bridge output filter rule \<1-999999\> vlan priority \<0-7\> -``` - -```{cfgcmd} set firewall bridge prerouting filter rule \<1-999999\> vlan priority \<0-7\> -``` - -```{cfgcmd} set firewall bridge name \ rule \<1-999999\> vlan priority \<0-7\> - -Match based on VLAN priority (Priority Code Point - PCP). Range is also -supported. -``` - -### Packet Modifications - - -Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify -packets before they are sent out. This feature provides more flexibility in -packet handling. - -```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set dscp \<0-63\> - -Set a specific value of Differentiated Services Codepoint (DSCP). -``` - -```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set mark \<1-2147483647\> - -Set a specific packet mark value. -``` - -```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set tcp-mss \<500-1460\> - -Set the TCP-MSS (TCP maximum segment size) for the connection. -``` - -```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set ttl \<0-255\> - -Set the TTL (Time to Live) value. -``` - -```{cfgcmd} set firewall bridge [prerouting | forward | output] filter rule \<1-999999\> set hop-limit \<0-255\> - -Set hop limit value. -``` - -```{cfgcmd} set firewall bridge [forward | output] filter rule \<1-999999\> set connection-mark \<0-2147483647\> - -Set connection mark value. -``` - -### Use IP firewall - -By default, for switched traffic, only the rules defined under `set firewall -bridge` are applied. There are two global-options that can be configured in -order to force deeper analysis of the packet on the IP layer. These options -are: - -```{cfgcmd} set firewall global-options apply-to-bridged-traffic ipv4 - -This command enables the IPv4 firewall for bridged traffic. If this option -is used, packets are also parsed by rules defined in ``set firewall ipv4 -...`` -``` - -```{cfgcmd} set firewall global-options apply-to-bridged-traffic ipv6 - -This command enables the IPv6 firewall for bridged traffic. If this option -is used, packets are also parsed by rules defined in ``set firewall ipv6 -...`` -``` - -## Operation-mode Firewall -### Rule-set overview - -In this section you can find all useful firewall op-mode commands. -General commands for firewall configuration, counter and statistics: - -```{opcmd} show firewall -``` - -```{opcmd} show firewall summary -``` - -```{opcmd} show firewall statistics -``` - -And, to print only bridge firewall information: - -```{opcmd} show firewall bridge -``` - -```{opcmd} show firewall bridge forward filter -``` - -```{opcmd} show firewall bridge forward filter rule \ -``` - -```{opcmd} show firewall bridge name \ -``` - -```{opcmd} show firewall bridge name \ rule \ -``` - -### Show Firewall log - -```{opcmd} show log firewall -``` - -```{opcmd} show log firewall bridge -``` - -```{opcmd} show log firewall bridge forward -``` - -```{opcmd} show log firewall bridge forward filter -``` - -```{opcmd} show log firewall bridge name \ -``` - -```{opcmd} show log firewall bridge forward filter rule \ -``` - -```{opcmd} show log firewall bridge name \ rule \ - -Show the logs of all firewall; show all bridge firewall logs; show all logs -for forward hook; show all logs for forward hook and priority filter; show -all logs for particular custom chain; show logs for specific Rule-Set. -``` - -### Example - -Configuration example: - -```none -set firewall bridge forward filter default-action 'drop' -set firewall bridge forward filter default-log -set firewall bridge forward filter rule 10 action 'continue' -set firewall bridge forward filter rule 10 inbound-interface name 'eth2' -set firewall bridge forward filter rule 10 vlan id '22' -set firewall bridge forward filter rule 20 action 'drop' -set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT' -set firewall bridge forward filter rule 20 vlan id '60' -set firewall bridge forward filter rule 30 action 'jump' -set firewall bridge forward filter rule 30 jump-target 'TEST' -set firewall bridge forward filter rule 30 outbound-interface name '!eth1' -set firewall bridge forward filter rule 35 action 'accept' -set firewall bridge forward filter rule 35 vlan id '11' -set firewall bridge forward filter rule 40 action 'continue' -set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11' -set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66' -set firewall bridge name TEST default-action 'accept' -set firewall bridge name TEST default-log -set firewall bridge name TEST rule 10 action 'continue' -set firewall bridge name TEST rule 10 log -set firewall bridge name TEST rule 10 vlan priority '0' -``` - -And op-mode commands: - -```none -vyos@BRI:~$ show firewall bridge -Rulesets bridge Information - ---------------------------------- -bridge Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- --------------------------------------------------------------------- -10 continue all 0 0 iifname "eth2" vlan id 22 continue -20 drop all 0 0 iifname @I_TRUNK-RIGHT vlan id 60 -30 jump all 2130 170688 oifname != "eth1" jump NAME_TEST -35 accept all 2080 168616 vlan id 11 accept -40 continue all 0 0 ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66 continue -default drop all 0 0 - ---------------------------------- -bridge Firewall "name TEST" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- -------------------------------------------------- -10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue -default accept all 2130 170688 - -vyos@BRI:~$ -vyos@BRI:~$ show firewall bridge name TEST -Ruleset Information - ---------------------------------- -bridge Firewall "name TEST" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- -------------------------------------------------- -10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue -default accept all 2130 170688 - -vyos@BRI:~$ -``` - -Inspect logs: - -```none -vyos@BRI:~$ show log firewall bridge -Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 -Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 -Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 -... -vyos@BRI:~$ show log firewall bridge forward filter -Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 -Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 -``` diff --git a/docs/configuration/firewall/md-flowtables.md b/docs/configuration/firewall/md-flowtables.md deleted file mode 100644 index 24d0675e..00000000 --- a/docs/configuration/firewall/md-flowtables.md +++ /dev/null @@ -1,176 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-flowtables-configuration)= - -# Flowtables Firewall Configuration - -```{include} /_include/need_improvement.txt -``` - - -## Overview - -This section provides information on firewall configuration for flowtables. - -```{cfgcmd} set firewall flowtable ... -``` - -To learn about the general traffic flow in VyOS firewalls, -see {doc}`Firewall `. - -```none -- set firewall - * flowtable - - custom_flow_table - + ... -``` - -Flowtables let you define a fastpath through the flowtable datapath. -Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP) -protocols. - -:::{figure} /_static/images/firewall-flowtable-packet-flow.webp -::: - -After the first packet successfully traverses the IP forwarding path (black -circles path), you can offload subsequent packets to the flowtable through your -ruleset. You specify when to add a flow to the flowtable during forward -filtering (red circle number 6). - -When a packet finds a matching entry in the flowtable (flowtable hit), the -system transmits it to the output netdevice. This means packets bypass the -classic IP forwarding path and use the **Fast Path** (orange circles path). -As a result, you do not see these packets from any Netfilter hooks after -ingress. If no matching entry exists in the flowtable (flowtable miss), the -packet traverses the classic IP forwarding path. - -:::{note} -**Flowtable Reference:** - -::: - -## Flowtable Configuration - -To use flowtables, you need to configure the following: -> - Create a flowtable that includes the interfaces -> that are going to be used by the flowtable. -> - Create a firewall rule. Set the action to -> `offload` and use your desired flowtable for `offload-target`. - -Creating a flow table: - -```{cfgcmd} set firewall flowtable \ interface \ - -Specify interfaces to use in the flowtable. -``` - -```{cfgcmd} set firewall flowtable \ description \ -``` - -Provide a description for the flow table. - -```{cfgcmd} set firewall flowtable \ offload \ - -Specify the offload type the flowtable uses: ``hardware`` or -``software``. The default is ``software`` offload. -``` -:::{note} -**Hardware offload**: Make sure your network interface controller -(NIC) supports hardware offloading and that you have the necessary drivers -> installed before enabling this option. -::: - -Creating rules for using flow tables: - -```{cfgcmd} set firewall [ipv4 | ipv6] forward filter rule \<1-999999\> action offload - -Create a firewall rule in the forward chain with the action set to -``offload``. -``` - -```{cfgcmd} set firewall [ipv4 | ipv6] forward filter rule \<1-999999\> offload-target \ - -Create a firewall rule in the forward chain and specify which flowtable -to use. Only applicable if the action is ``offload``. -``` - -## Configuration Example - -Consider the following in this setup: -> - This example uses two interfaces in the flowtables: `eth0` and `eth1`. -> - The example provides a minimal firewall ruleset with filtering rules -> and rules for using flowtable offload capabilities. - -The first packet is evaluated by the firewall path, so a -desired connection should be explicitly accepted. -The same should occur for traffic in reverse order. -In most cases, state policies are -used to accept a connection in the reverse path. - -In the following example only traffic coming from interface `eth0`, -TCP protocol, and destination port 1122 is accepted. -All other traffic to the router is dropped. - -### Commands - -```none -set firewall flowtable FT01 interface 'eth0' -set firewall flowtable FT01 interface 'eth1' -set firewall ipv4 forward filter default-action 'drop' -set firewall ipv4 forward filter rule 10 action 'offload' -set firewall ipv4 forward filter rule 10 offload-target 'FT01' -set firewall ipv4 forward filter rule 10 state 'established' -set firewall ipv4 forward filter rule 10 state 'related' -set firewall ipv4 forward filter rule 20 action 'accept' -set firewall ipv4 forward filter rule 20 state 'established' -set firewall ipv4 forward filter rule 20 state 'related' -set firewall ipv4 forward filter rule 110 action 'accept' -set firewall ipv4 forward filter rule 110 destination address '192.0.2.100' -set firewall ipv4 forward filter rule 110 destination port '1122' -set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0' -set firewall ipv4 forward filter rule 110 protocol 'tcp' -``` - -### Explanation - -Here's what happens for a desired connection: -> 1. A packet arrives on `eth0` with destination address `192.0.2.100`, TCP -> protocol, and destination port 1122. Assume this address is reachable -> through interface `eth1`. -> 2. For this first packet, the connection state is **new**. Neither rule 10 -> nor rule 20 applies. -> 3. Rule 110 matches, so the connection is accepted. -> 4. When the server 192.0.2.100 replies, the connection state becomes -> **established**, and rule 20 accepts the reply. -> 5. The router receives the second packet for this connection. Because the -> connection state is **established**, rule 10 matches and adds a new -> entry in the flowtable FT01 for this connection. -> 6. Subsequent packets skip the traditional path and use the **Fast Path** -> for offloading. - -### Checks - -Check the conntrack table to verify that the system accepted and properly -offloaded connections. - -```none -vyos@FlowTables:~$ show firewall ipv4 forward filter -Ruleset Information - ---------------------------------- -ipv4 Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------------------------------- -10 offload all 8 468 ct state { established, related } flow add @VYOS_FLOWTABLE_FT01 -20 accept all 8 468 ct state { established, related } accept -110 accept tcp 2 120 ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0" accept -default drop all 7 420 - -vyos@FlowTables:~$ sudo conntrack -L | grep tcp -conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown. -tcp 6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2 -vyos@FlowTables:~$ -``` diff --git a/docs/configuration/firewall/md-global-options.md b/docs/configuration/firewall/md-global-options.md deleted file mode 100644 index 0f6d91ac..00000000 --- a/docs/configuration/firewall/md-global-options.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-global-options-configuration)= - -# Global Options Firewall Configuration - -## Overview - -Some firewall settings are global and affect the entire system. This section -provides information about these global options that you can configure using -the VyOS CLI. - -Configuration commands covered in this section: - -```{cfgcmd} set firewall global-options ... -``` - -## Configuration - -```{cfgcmd} set firewall global-options all-ping [enable | disable] - -By default, when VyOS receives an ICMP echo request packet destined for -itself, it answers with an ICMP echo reply, unless your firewall prevents -it. - -You can set firewall rules to accept, drop, or reject ICMP in, out, or -local traffic. You can also use the **firewall global-options all-ping** -command. This command affects only LOCAL traffic (packets destined for your -VyOS system), not IN or OUT traffic. - -:::{note} -**firewall global-options all-ping** affects only LOCAL traffic -and always behaves in the most restrictive way -::: -:::{code-block} none -set firewall global-options all-ping enable -::: -When you set this command, VyOS answers every ICMP echo request addressed -to itself, but that response occurs only if no other rule drops or rejects -local echo requests. In case of conflict, VyOS does not answer ICMP echo -requests. - -:::{code-block} none -set firewall global-options all-ping disable -::: -When you set this command, VyOS answers no ICMP echo requests addressed to -itself, regardless of where they come from or what specific rules accept -them. -``` - -```{cfgcmd} set firewall global-options apply-to-bridged-traffic [ipv4 | ipv6] - -Apply IPv4 or IPv6 firewall rules to bridged traffic. -``` - -```{cfgcmd} set firewall global-options broadcast-ping [enable | disable] - -Enable or disable the response to ICMP broadcast messages. The system -alters the following parameter: -* ``net.ipv4.icmp_echo_ignore_broadcasts`` -``` - -```{cfgcmd} set firewall global-options ip-src-route [enable | disable] -``` - -```{cfgcmd} set firewall global-options ipv6-src-route [enable | disable] - -Set whether VyOS accepts packets with a source route option. -The following sysctl parameters will be changed: -* ``net.ipv4.conf.all.accept_source_route`` -* ``net.ipv6.conf.all.accept_source_route`` -``` - -```{cfgcmd} set firewall global-options receive-redirects [enable | disable] -``` - -```{cfgcmd} set firewall global-options ipv6-receive-redirects [enable | disable] - -Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages. -The following sysctl parameters will be changed: -* ``net.ipv4.conf.all.accept_redirects`` -* ``net.ipv6.conf.all.accept_redirects`` -``` - -```{cfgcmd} set firewall global-options send-redirects [enable | disable] - -Allow VyOS to send ICMPv4 redirect messages. -The following sysctl parameter will be changed: -* ``net.ipv4.conf.all.send_redirects`` -``` - -```{cfgcmd} set firewall global-options log-martians [enable | disable] - -Allow VyOS to log martian IPv4 packets. -The following sysctl parameter will be changed: -* ``net.ipv4.conf.all.log_martians`` -``` - -```{cfgcmd} set firewall global-options source-validation [strict | loose | disable] - -Set the IPv4 source validation mode. -The following sysctl parameter will be changed: -* ``net.ipv4.conf.all.rp_filter`` -``` - -```{cfgcmd} set firewall global-options syn-cookies [enable | disable] - -Allow VyOS to use IPv4 TCP SYN Cookies. -The following sysctl parameter will be changed: -* ``net.ipv4.tcp_syncookies`` -``` - -```{cfgcmd} set firewall global-options twa-hazards-protection [enable | disable] - -Enable or disable VyOS {rfc}`1337` conformance. -The following sysctl parameter will be changed: -* ``net.ipv4.tcp_rfc1337`` -``` - -```{cfgcmd} set firewall global-options state-policy established action [accept | drop | reject] -``` - -```{cfgcmd} set firewall global-options state-policy established log -``` - -```{cfgcmd} set firewall global-options state-policy established log-level [emerg | alert | crit | err | warn | notice | info | debug] - -Set the global setting for an established connection. -``` - -```{cfgcmd} set firewall global-options state-policy invalid action [accept | drop | reject] -``` - -```{cfgcmd} set firewall global-options state-policy invalid log -``` - -```{cfgcmd} set firewall global-options state-policy invalid log-level [emerg | alert | crit | err | warn | notice | info | debug] - -Set the global setting for invalid packets. -``` - -```{cfgcmd} set firewall global-options state-policy related action [accept | drop | reject] -``` - -```{cfgcmd} set firewall global-options state-policy related log -``` - -```{cfgcmd} set firewall global-options state-policy related log-level [emerg | alert | crit | err | warn | notice | info | debug] - -Set the global setting for related connections. -``` - -VyOS supports setting timeouts for connections by connection type. You can -set timeout values for generic connections, ICMP connections, UDP -connections, or TCP connections in various states. - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout icmp <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout other <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp close <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp close-wait <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp established <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp fin-wait <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp last-ack <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp syn-recv <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp syn-sent <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout tcp time-wait <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout udp other <1-21474836> - :defaultvalue: -.. cfgcmd:: set firewall global-options timeout udp stream <1-21474836> - :defaultvalue: - - Set the timeout in seconds for a protocol or state. -``` \ No newline at end of file diff --git a/docs/configuration/firewall/md-groups.md b/docs/configuration/firewall/md-groups.md deleted file mode 100644 index 817f610e..00000000 --- a/docs/configuration/firewall/md-groups.md +++ /dev/null @@ -1,477 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-groups-configuration)= - -# Firewall groups - -## Configuration - -Firewall groups represent collections of IP addresses, networks, ports, -MAC addresses, domains, or interfaces. You can reference a group in firewall, -NAT, and policy route rules as either a source or destination matcher, and/or -as inbound or outbound in the case of interface groups. - -### Address Groups - -An **address group** contains a single IP address or IP address range. - -```{cfgcmd} set firewall group address-group \ address [address | address range] - -``` -```{cfgcmd} set firewall group ipv6-address-group \ address \ - -Define an IPv4 or IPv6 address group. - -:::{code-block} none -set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1 -set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8 -set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1 -::: -``` - -```{cfgcmd} set firewall group address-group \ description \ -``` - -```{cfgcmd} set firewall group ipv6-address-group \ description \ - -Provide an IPv4 or IPv6 address group description. -``` - -### Remote Groups - -A **remote-group** uses a URL that hosts a newline-delimited list of IPv4 -and/or IPv6 addresses, CIDRs, and ranges. VyOS pulls this list periodically -according to the frequency you define in the firewall **resolver-interval** -and loads matching entries into the group for use in rules. The list is cached -in persistent storage, so rules continue to function if updates fail. - -```{cfgcmd} set firewall group remote-group \ url \ - -Specify a remote list of IPv4 and/or IPv6 addresses, ranges, and CIDRs -to fetch. -``` - -```{cfgcmd} set firewall group remote-group \ description \ - -Set a description for a remote group. -``` - -The remote list format is flexible. VyOS attempts to parse the first word of -each line as an entry and skips lines it cannot match. Lines that begin with -an alphanumeric character but do not match valid IPv4 or IPv6 addresses, -ranges, or CIDRs are logged to the system log. The following examples show -acceptable formats that VyOS parses correctly: - -```none -127.0.0.1 -127.0.0.0/24 -127.0.0.1-127.0.0.254 -2001:db8::1 -2001:db8:cafe::/48 -2001:db8:cafe::1-2001:db8:cafe::ffff -``` - -### Network Groups - -**Network groups** accept IP networks in CIDR notation. You can add specific -IP addresses as a 32-bit prefix. If you need to add a mix of addresses and -networks, use a network group. - -```{cfgcmd} set firewall group network-group \ network \ -``` - -```{cfgcmd} set firewall group ipv6-network-group \ network \ - -Define an IPv4 or IPv6 network group. - -:::{code-block} none -set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24 -set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24 -set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64 -::: -``` - -```{cfgcmd} set firewall group network-group \ description \ -``` - -```{cfgcmd} set firewall group ipv6-network-group \ description \ - -Provide an IPv4 or IPv6 network group description. -``` - -### Interface Groups - -An **interface group** represents a collection of interfaces. - -```{cfgcmd} set firewall group interface-group \ interface \ - -Define an interface group. -Wildcard ``*`` is supported. For example: ``eth3*``. -Prepend the character ``!`` to invert the criteria. For example: ``!eth2``. -``` - -```none -set firewall group interface-group LAN interface bond1001 -set firewall group interface-group LAN interface eth3* -``` - -```{cfgcmd} set firewall group interface-group \ description \ - -Provide an interface group description. -``` - -### Port Groups - -A **port group** represents only port numbers, not the protocol. You can -reference port groups for either TCP or UDP. Create TCP and UDP groups -separately to avoid accidentally filtering unnecessary ports. Specify port -ranges by using `-`. - -```{cfgcmd} set firewall group port-group \ port [portname | portnumber | startport-endport] - -Define a port group. A port name can be any name defined in -/etc/services. For example, ``http``. - -:::{code-block} none -set firewall group port-group PORT-TCP-SERVER1 port http -set firewall group port-group PORT-TCP-SERVER1 port 443 -set firewall group port-group PORT-TCP-SERVER1 port 5000-5010 -::: -``` - -```{cfgcmd} set firewall group port-group \ description \ - -Provide a port group description. -``` - -### MAC Groups - -A **mac group** represents a collection of mac addresses. - -```{cfgcmd} set firewall group mac-group \ mac-address \ - -Define a mac group. -``` - -```none -set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f -set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81 -``` - -```{cfgcmd} set firewall group mac-group \ description \ - -Provide a MAC group description. -``` - -### Domain Groups - -A **domain group** represents a collection of domains. - -```{cfgcmd} set firewall group domain-group \ address \ - -Define a domain group. -``` - -```none -set firewall group domain-group DOM address example.com -``` - -```{cfgcmd} set firewall group domain-group \ description \ - -Provide a domain group description. -``` - -### Dynamic Groups - -Firewall dynamic groups differ from other groups because you can use them as -source/destination in firewall rules, and members are not defined statically -in VyOS configuration. Instead, firewall rules dynamically add members to -these groups. - -#### Defining Dynamic Address Groups - -Dynamic address groups support both IPv4 and IPv6 families. Use these -commands to define dynamic IPv4 and IPv6 address groups: - -```{cfgcmd} set firewall group dynamic-group address-group \ -``` - -```{cfgcmd} set firewall group dynamic-group ipv6-address-group \ -``` - -Add description to firewall groups: - -```{cfgcmd} set firewall group dynamic-group address-group \ description \ -``` - -```{cfgcmd} set firewall group dynamic-group ipv6-address-group \ description \ -``` - -#### Adding elements to Dynamic Firewall Groups - -After you define dynamic firewall groups, use them in firewall rules to -dynamically add elements to them. - -Commands used for this task are: -- Add destination IP address of the connection to a dynamic address group: - -```{cfgcmd} set firewall ipv4 [forward | input | output] filter rule \<1-999999\> add-address-to-group destination-address address-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> add-address-to-group destination-address address-group \ -``` - -```{cfgcmd} set firewall ipv6 [forward | input | output] filter rule \<1-999999\> add-address-to-group destination-address address-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> add-address-to-group destination-address address-group \ -``` - -- Add source IP address of the connection to a dynamic address group: - -```{cfgcmd} set firewall ipv4 [forward | input | output] filter rule \<1-999999\> add-address-to-group source-address address-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> add-address-to-group source-address address-group \ -``` - -```{cfgcmd} set firewall ipv6 [forward | input | output] filter rule \<1-999999\> add-address-to-group source-address address-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> add-address-to-group source-address address-group \ -``` - -You can define specific timeouts per rule. When a rule matches, the source or -destination address is added to the group, and the element remains in the group -until the timeout expires. If you do not define a timeout, the element remains -in the group until the next reboot or until you commit firewall configuration -changes. - -```{cfgcmd} set firewall ipv4 [forward | input | output] filter rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ -``` - -```{cfgcmd} set firewall ipv6 [forward | input | output] filter rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> add-address-to-group [destination-address | source-address] timeout \ -``` - -Timeout can be defined using seconds, minutes, hours or days: - -```none -set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout -Possible completions: -s Timeout value in seconds -m Timeout value in minutes -h Timeout value in hours -d Timeout value in days -``` - -#### Using Dynamic Firewall Groups - -Like other firewall groups, you can use dynamic firewall groups in firewall -rules as matching options. For example: - -```none -set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO -set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR -``` - -## Examples - -### General example - -After you create firewall groups, you can reference them in firewall, NAT, -NAT66, and/or policy-route rules. The following example creates multiple -groups: - -```{eval-rst} - .. code-block:: none - - set firewall group address-group SERVERS address 198.51.100.101 - set firewall group address-group SERVERS address 198.51.100.102 - set firewall group network-group TRUSTEDv4 network 192.0.2.0/30 - set firewall group network-group TRUSTEDv4 network 203.0.113.128/25 - set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64 - set firewall group interface-group LAN interface eth2.2001 - set firewall group interface-group LAN interface bon0 - set firewall group port-group PORT-SERVERS port http - set firewall group port-group PORT-SERVERS port 443 - set firewall group port-group PORT-SERVERS port 5000-5010 -``` - -And next, some configuration example where groups are used: - -```{eval-rst} - .. code-block:: none - - set firewall ipv4 output filter rule 10 action accept - set firewall ipv4 output filter rule 10 outbound-interface group !LAN - set firewall ipv4 forward filter rule 20 action accept - set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4 - set firewall ipv6 input filter rule 10 action accept - set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6 - set nat destination rule 101 inbound-interface group LAN - set nat destination rule 101 destination group address-group SERVERS - set nat destination rule 101 protocol tcp - set nat destination rule 101 destination group port-group PORT-SERVERS - set nat destination rule 101 translation address 203.0.113.250 - set policy route PBR rule 201 destination group port-group PORT-SERVERS - set policy route PBR rule 201 protocol tcp - set policy route PBR rule 201 set table 15 -``` - -### Port knocking example - -You can use dynamic firewall groups with port knocking to secure access to -the router or any other device. The following example shows a 4-step port -knocking configuration: - -```{eval-rst} - .. code-block:: none - - set firewall global-options state-policy established action 'accept' - set firewall global-options state-policy invalid action 'drop' - set firewall global-options state-policy related action 'accept' - set firewall group dynamic-group address-group ALLOWED - set firewall group dynamic-group address-group PN_01 - set firewall group dynamic-group address-group PN_02 - set firewall ipv4 input filter default-action 'drop' - set firewall ipv4 input filter rule 5 action 'accept' - set firewall ipv4 input filter rule 5 protocol 'icmp' - set firewall ipv4 input filter rule 10 action 'drop' - set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01' - set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m' - set firewall ipv4 input filter rule 10 description 'Port_nock 01' - set firewall ipv4 input filter rule 10 destination port '9990' - set firewall ipv4 input filter rule 10 protocol 'tcp' - set firewall ipv4 input filter rule 20 action 'drop' - set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02' - set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m' - set firewall ipv4 input filter rule 20 description 'Port_nock 02' - set firewall ipv4 input filter rule 20 destination port '9991' - set firewall ipv4 input filter rule 20 protocol 'tcp' - set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01' - set firewall ipv4 input filter rule 30 action 'drop' - set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED' - set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h' - set firewall ipv4 input filter rule 30 description 'Port_nock 03' - set firewall ipv4 input filter rule 30 destination port '9992' - set firewall ipv4 input filter rule 30 protocol 'tcp' - set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02' - set firewall ipv4 input filter rule 99 action 'accept' - set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh' - set firewall ipv4 input filter rule 99 destination port '22' - set firewall ipv4 input filter rule 99 protocol 'tcp' - set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED' -``` - -Before testing, we can check the members of firewall groups: - -```none -vyos@vyos# run show firewall group -Firewall Groups - -Name Type References Members Timeout Expires -------- ---------------------- -------------------- ------------- --------- --------- -ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D -PN_01 address_group(dynamic) ipv4-input-filter-10 N/D N/D N/D -PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D -[edit] -vyos@vyos# -``` - -With this configuration, to gain SSH access to the router, the user must: - -1. Create a new TCP connection to destination port 9990. A new entry is added - to dynamic firewall group `PN_01`. - - ```none - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 119 - PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D - [edit] - vyos@vyos# - ``` - -2. Create a new TCP connection to destination port 9991. A new entry is added - to dynamic firewall group `PN_02`. - - ```none - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 106 - PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 179 - [edit] - vyos@vyos# - ``` - -3. Create a new TCP connection to destination port 9992. A new entry is added - to dynamic firewall group `ALLOWED`. - - ```none - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.89.31 7200 7199 - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 89 - PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 170 - [edit] - vyos@vyos# - ``` - -4. Now you can connect via SSH to the router (assuming SSH is - configured). - -## Operation-mode - -```{opcmd} show firewall group -``` - -```{opcmd} show firewall group \ - -Display an overview of defined groups, including the firewall group name, -type, references (where the group is used), members, timeout, and -expiration (the last two only apply to dynamic firewall groups). -``` - -Here is an example of such command: - -```none -vyos@vyos:~$ show firewall group -Firewall Groups - -Name Type References Members Timeout Expires ------------- ---------------------- ---------------------- ---------------- --------- --------- -SERVERS address_group nat-destination-101 198.51.100.101 - 198.51.100.102 -ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.77.39 7200 7174 -PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.0.245 120 112 - 192.168.77.39 120 85 -PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.77.39 180 151 -LAN interface_group ipv4-output-filter-10 bon0 - nat-destination-101 eth2.2001 -TRUSTEDv6 ipv6_network_group ipv6-input-filter-10 2001:db8::/64 -TRUSTEDv4 network_group ipv4-forward-filter-20 192.0.2.0/30 - 203.0.113.128/25 -PORT-SERVERS port_group route-PBR-201 443 - route-PBR-201 5000-5010 - nat-destination-101 http -vyos@vyos:~$ -``` diff --git a/docs/configuration/firewall/md-index.md b/docs/configuration/firewall/md-index.md deleted file mode 100644 index 9108a800..00000000 --- a/docs/configuration/firewall/md-index.md +++ /dev/null @@ -1,278 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -# Firewall - -:::{warning} -Due to a boot-time race condition, all interfaces initialize -before the firewall. This temporarily leaves the system open to all traffic -and poses a security risk. -::: - -VyOS uses Netfilter. The Netfilter -project developed `iptables` and its successor `nftables` for the Linux -kernel to process packet data flows directly. This extends the concept of -zone-based security to let you manipulate data at multiple stages after the -network interface and driver accept it, and before sending it to its -destination (for example, a web server or another device). - -The following is a simplified traffic flow diagram based on Netfilter -packet flow. -This diagram provides an overview of how packets are processed and the -possible paths traffic can take. - -:::{figure} /_static/images/firewall-gral-packet-flow.webp -::: - -The main points regarding packet flow and terminology in VyOS firewall -are: - -- **Bridge Port?**: Choose the appropriate path based on whether the - interface where the packet was received is part of a bridge. - -If the interface where the packet was received is not part of a bridge, the -packet is processed at the **IP Layer**: - -```{eval-rst} - * **Prerouting**: The router processes all packets in this stage, - regardless of the destination. You can perform several actions in - this stage, and these actions are also defined in different parts of the - VyOS configuration. Order is important. The relevant configuration that - applies in this stage includes: - - * **Firewall prerouting**: Rules you define under ``set firewall - [ipv4 | ipv6] prerouting raw...``. The system processes all rules in - this section before the connection tracking subsystem. - - * **Conntrack Ignore**: Rules you define under ``set system conntrack - ignore [ipv4 | ipv6] ...``. You can configure this section with - ``firewall [ipv4 | ipv6] prerouting ...``. For compatibility reasons, - this feature is supported, but will be deprecated in the future. - - * **Policy Route**: Rules you define under ``set policy [route | - route6] ...``. - - * **Destination NAT**: Rules you define under ``set [nat | nat66] - destination...``. - - * **Destination is the router?**: Choose the appropriate path based on the - destination IP address. Transit traffic continues to **forward**, while - traffic destined for the router continues to **input**. - - * **Input**: The stage where you filter and control traffic destined for - the router itself. This is where you enforce all rules for securing the - router. This includes IPv4 and IPv6 filtering rules, defined in: - - * ``set firewall ipv4 input filter ...``. - - * ``set firewall ipv6 input filter ...``. - - * **Forward**: The stage where you filter and control transit traffic. - This includes IPv4 and IPv6 filtering rules, defined in: - - * ``set firewall ipv4 forward filter ...``. - - * ``set firewall ipv6 forward filter ...``. - - * **Output**: The stage where you filter and control traffic that the - router originates. Note that this traffic comes from either a new - connection that an internal process on the VyOS router (such as NTP) - originates or a response to traffic the router receives externally through - **input** (for example, a response to an SSH login attempt). This includes - IPv4 and IPv6 rules, and two different sections apply: - - * **Output Prerouting**: ``set firewall [ipv4 | ipv6] output - raw ...``. As described in **Prerouting**, the system processes - rules in this section before the connection tracking subsystem. - - * **Output Filter**: ``set firewall [ipv4 | ipv6] output filter ...``. - - * **Postrouting**: As in **Prerouting**, you can perform several actions - defined in different parts of VyOS configuration in this stage. This - includes: - - * **Source NAT**: Rules you define under ``set [nat | nat66] - source...``. -``` - -If the interface where the packet was received is part of a bridge, the -packet is processed at the **Bridge Layer**: - -```{eval-rst} - * **Prerouting (Bridge)**: The bridge processes all packets it receives in - this stage, regardless of the destination. First, you can apply filters - here, or you can configure rules that ignore the connection tracking - system. The relevant configuration that applies: - - * ``set firewall bridge prerouting filter ...``. - - * **Forward (Bridge)**: The stage where you filter and control traffic - that passes through the bridge: - - * ``set firewall bridge forward filter ...``. - - * **Input (Bridge)**: The stage where you filter and control traffic - destined for the bridge itself: - - * ``set firewall bridge input filter ...``. - - * **Output (Bridge)**: The stage where you filter and control traffic that - the bridge originates: - - * ``set firewall bridge output filter ...``. -``` - -The following is the overall structure of the VyOS firewall CLI: - -```none -- set firewall - * bridge - - forward - + filter - - input - + filter - - output - + filter - - prerouting - + filter - - name - + custom_name - * flowtable - - custom_flow_table - + ... - * global-options - + all-ping - + broadcast-ping - + ... - * group - - address-group - - ipv6-address-group - - network-group - - ipv6-network-group - - interface-group - - mac-group - - port-group - - domain-group - * ipv4 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name - * ipv6 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - ipv6-name - + custom_name - * zone - - custom_zone_name - + ... -``` - -Here is a list of VyOS firewall CLI subcommands and their -corresponding pages in the documentation: - -```{cfgcmd} set firewall bridge ... - -Configure bridge firewall rules for traffic at the bridge layer. -See the Bridge Firewall Configuration page for detailed information. -``` - -```{cfgcmd} set firewall flowtable ... - -Configure firewall flowtables for stateful connection tracking and rules. -See the Flowtables Firewall Configuration page for detailed information. -``` - -```{cfgcmd} set firewall global-options ... - -Configure global firewall options such as ``all-ping``, ``broadcast-ping``, -``syn-cookies``, and other system-wide firewall settings. -See the Global Firewall Options page for detailed information. -``` - -```{cfgcmd} set firewall group ... - -Organize firewall rules by creating reusable address, network, interface, -MAC, port, and domain groups. Use groups in multiple rules to simplify -configuration and maintenance. -See the Firewall Groups page for detailed information. -``` - -```{cfgcmd} set firewall ipv4 ... - -Configure IPv4-specific firewall rules. -See the IPv4 Firewall Configuration page for detailed information. -``` - -```{cfgcmd} set firewall ipv6 ... - -Configure IPv6-specific firewall rules. -See the IPv6 Firewall Configuration page for detailed information. -``` - -```{cfgcmd} set firewall zone ... - -Configure zone-based firewall policies for controlling traffic between -different network zones. -See the Zone-Based Firewall Configuration page for detailed information. -``` - -For more information on firewall configuration, see the following pages: - -```{toctree} -:includehidden: true -:maxdepth: 1 - -global-options -groups -bridge -ipv4 -ipv6 -flowtables -``` - -:::{note} -For more information on Netfilter hooks and Linux networking packet flows, -see the [Netfilter-Hooks]() -documentation. -::: - -## Zone-Based firewall - -```{toctree} -:includehidden: true -:maxdepth: 1 - -zone -``` - -With zone-based firewalls, a new concept applies. In addition to the standard -in and out traffic flows, a local flow enables traffic originating from and -destined to the router itself. This means you must configure additional rules to -secure the firewall from the network, in addition to the existing inbound and -outbound rules. - -To configure VyOS with zone-based firewall, see -{doc}`Zone-Based Firewall Configuration `. - -As the following example image shows, you must configure rules to allow or block -traffic to or from the services running on the device that have open -connections on that interface. - -:::{figure} /_static/images/firewall-zonebased.webp -::: diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md deleted file mode 100644 index e5c0a986..00000000 --- a/docs/configuration/firewall/md-ipv4.md +++ /dev/null @@ -1,1517 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-ipv4-configuration)= - -# IPv4 Firewall Configuration - -## Overview - -This section provides information on IPv4 firewall configuration and -appropriate operation-mode commands. This section covers the following -configuration commands: - -```{cfgcmd} set firewall ipv4 ... -``` - -To learn about the general traffic flow in VyOS firewalls, see {doc}`Firewall `. - -```none -- set firewall - * ipv4 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name -``` - -First, the router receives all traffic and processes it in the **prerouting** -stage. - -This stage includes: - -- **Firewall Prerouting**: commands found under `set firewall ipv4 - prerouting raw ...` -- {doc}`Conntrack Ignore`: `set system - conntrack ignore ipv4...` -- {doc}`Policy Route`: commands found under - `set policy route ...` -- {doc}`Destination NAT`: commands found under - `set nat destination ...` - -For transit traffic, which is received by the router and forwarded, the base -chain is **forward**. The following is a simplified packet flow diagram for -transit traffic: - -:::{figure} /_static/images/firewall-fwd-packet-flow.webp -::: - -The base firewall chain for configuring filtering rules for transit traffic is -`set firewall ipv4 forward filter ...`, which occurs in stage 5, highlighted -in red. - -For traffic to the router itself, the base chain is **input**. For traffic -the router originates, the base chain is **output**. A simplified packet flow -diagram is shown next, which shows the path for traffic destined to the router -itself and traffic the router generates (starting from circle number 6): - -:::{figure} /_static/images/firewall-input-packet-flow.webp -::: - -The base chain for traffic towards the router is -`set firewall ipv4 input filter ...` - -The base chain for traffic the router generates is `set firewall ipv4 -output ...`, where two sub-chains are available: **filter** and **raw**: - -- **Output Prerouting**: `set firewall ipv4 output raw ...`. As described - in **Prerouting**, the system processes rules in this section before the - connection tracking subsystem. -- **Output Filter**: `set firewall ipv4 output filter ...`. The system - processes rules in this section after the connection tracking subsystem. - -:::{note} -**Important note about default-actions:** -If you do not define a default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop**. -::: - -You can create custom firewall chains using the following commands: -`set firewall ipv4 name ...`. To use a custom chain, you must define -a rule with the **action jump** and the appropriate **target** in a base -chain. - -## Firewall - IPv4 Rules - -Each firewall rule has a -number, an action to apply if the rule matches, and the ability to specify -multiple matching criteria. Packets traverse rules numbered 1-999999, so order -is crucial. The system executes the rule action at the first match. - -### Actions - -If you define a rule, you must define an action for it. The action tells the -firewall what to do if all the criteria you define for that rule are met. - -The action can be: - -- `accept`: Accept the packet. -- `continue`: Continue parsing the next rule. -- `drop`: Drop the packet. -- `reject`: Reject the packet. -- `jump`: Jump to another custom chain. -- `return`: Return from the current chain and continue at the next rule - of the last chain. -- `queue`: Enqueue packet to userspace. -- `synproxy`: Synproxy the packet. - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] - -This required setting defines the action of the current rule. If you set -the action to jump, you must also specify a jump-target. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> jump-target \ - -Use this command only when the action is set to ``jump``. Specify the -jump target. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> queue \<0-65535\> - -Use this command only when the action is set to ``queue``. Specify the -queue target to use. Queue range is also supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> queue-options bypass - -Use this command only when the action is set to ``queue``. Allow the packet -to pass through the firewall when no userspace software is connected to the -queue. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> queue-options fanout - -Use this command only when the action is set to ``queue``. Distribute -packets between several queues. -``` - -Also, **default-action** is an action that applies when a packet does not -match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -```{cfgcmd} set firewall ipv4 forward filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall ipv4 input filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall ipv4 output filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall ipv4 name \ default-action [accept | drop | jump | queue | reject | return] - -This command sets the default action of the rule-set if a packet does not -match the criteria of any rule. If you set the default-action to ``jump``, -you must also specify ``default-jump-target``. Note that for base chains, -you can set the default action only to ``accept`` or ``drop``, while on -custom chains, more actions are available. -``` - -```{cfgcmd} set firewall ipv4 name \ default-jump-target \ - -Use this command only when you set ``default-action`` to ``jump``. Specify -the jump target for the default rule. -``` -:::{note} -**Important note about default-actions:** -If you do not define a default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop**. -::: - -### Firewall Logs - -You can enable logging for every single firewall rule. If you enable logging, -you can define other log options. - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log - -Enable logging for the matched packet. If this command is not present, then -logging is not enabled. -``` - -```{cfgcmd} set firewall ipv4 forward filter default-log -``` - -```{cfgcmd} set firewall ipv4 input filter default-log -``` - -```{cfgcmd} set firewall ipv4 output filter default-log -``` - -```{cfgcmd} set firewall ipv4 name \ default-log - -Use this command to enable logging of the default action on the specified -chain. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] - -Define the log level. Only applicable if you enable rule logging. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options group \<0-65535\> - -Define the log group to send messages to. Only applicable if you enable rule -logging. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options snapshot-length \<0-9000\> - -Define the length of packet payload to include in a netlink message. Only -applicable if you enable rule logging and define the log group. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> log-options queue-threshold \<0-65535\> - -Define the number of packets to queue inside the kernel before sending them -to userspace. Only applicable if you enable rule logging and define the log -group. -``` - -### Firewall Description - -You can add a description for reference for every single rule and for every -defined custom chain. - -```{cfgcmd} set firewall ipv4 name \ description \ - -Provide a rule-set description for a custom firewall chain. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> description \ - -Provide a description for each rule. -``` - -### Rule Status - -When you define a rule, it is enabled by default. In some cases, it is useful -to disable the rule rather than removing it. - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> disable - -Command for disabling a rule but keeping it in the configuration. -``` - -### Matching criteria - -There are a lot of matching criteria against which the packet can be tested. - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> connection-status nat [destination | source] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> connection-status nat [destination | source] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> connection-status nat [destination | source] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> connection-status nat [destination | source] - -Match based on nat connection status. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> connection-mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> connection-mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> connection-mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> connection-mark \<1-2147483647\> - -Match based on connection mark. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> conntrack-helper \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> conntrack-helper \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> conntrack-helper \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> conntrack-helper \ - -Match based on connection tracking protocol helper module to secure use of -that helper module. See below for possible completions \. - -:::{code-block} none -Possible completions: -ftp Related traffic from FTP helper -h323 Related traffic from H.323 helper -pptp Related traffic from PPTP helper -nfs Related traffic from NFS helper -sip Related traffic from SIP helper -tftp Related traffic from TFTP helper -sqlnet Related traffic from SQLNet helper -::: -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination address [address | addressrange | CIDR] - -Match criteria based on source and/or destination address. This is similar -to the network groups part, but here you are able to negate the matching -addresses. - -:::{code-block} none -set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11 -# with a '!' the rule match everything except the specified subnet -set firewall ipv4 name FOO rule 51 source address !203.0.113.0/24 -::: -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination address-mask [address] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination address-mask [address] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination address-mask [address] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination address-mask [address] - -An arbitrary netmask can be applied to mask addresses to only match against -a specific portion. - -This functions for both individual addresses and address groups. - -:::{code-block} none -# Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet -set firewall ipv4 name FOO rule 100 destination address 0.11.0.13 -set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255 -::: -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination fqdn \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination fqdn \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination fqdn \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination fqdn \ - -Specify a Fully Qualified Domain Name as source/destination to match. Ensure -that the router is able to resolve this dns query. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination geoip inverse-match -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination geoip inverse-match -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination geoip inverse-match -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination geoip inverse-match - -Match IP addresses based on its geolocation. More info: geoip matching. -Use inverse-match to match anything except the given country-codes. -``` - -Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, -permits redistribution so we can include a database in images(~3MB -compressed). Includes cron script (manually callable by op-mode update -geoip) to keep database and rules updated. - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source mac-address \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source mac-address \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source mac-address \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source mac-address \ - -You can only specify a source mac-address to match. - -:::{code-block} none -set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33 -set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34 -::: -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination port [1-65535 | portname | start-end] - -A port can be set by number or name as defined in ``/etc/services``. - -:::{code-block} none -set firewall ipv4 forward filter rule 10 source port '22' -set firewall ipv4 forward filter rule 11 source port '!http' -set firewall ipv4 forward filter rule 12 source port 'https' -::: -Multiple source ports can be specified as a comma-separated list. -The whole list can also be "negated" using ``!``. For example: -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group address-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group address-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group address-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group address-group \ - -Use a specific address-group. Prepending the character ``!`` to invert the -criteria to match is also supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group dynamic-address-group \ - -Use a specific dynamic-address-group. Prepending the character ``!`` to -invert the criteria to match is also supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group network-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group network-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group network-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group network-group \ - -Use a specific network-group. Prepending the character ``!`` to invert the -criteria to match is also supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group port-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group port-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group port-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group port-group \ - -Use a specific port-group. Prepending the character ``!`` to invert the -criteria to match is also supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group domain-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group domain-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group domain-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group domain-group \ - -Use a specific domain-group. Prepending the character ``!`` to invert the -criteria to match is also supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> destination group mac-group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> destination group mac-group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> destination group mac-group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> destination group mac-group \ - -Use a specific mac-group. Prepending the character ``!`` to invert the -criteria to match is also supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> dscp-exclude [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> dscp-exclude [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> dscp-exclude [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> dscp-exclude [0-63 | start-end] - -Match based on dscp value. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> fragment [match-frag | match-non-frag] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> fragment [match-frag | match-non-frag] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> fragment [match-frag | match-non-frag] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> fragment [match-frag | match-non-frag] - -Match based on fragmentation. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> icmp [code | type] \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> icmp [code | type] \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> icmp [code | type] \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> icmp [code | type] \<0-255\> - -Match based on icmp code and type. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> icmp type-name \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> icmp type-name \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> icmp type-name \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> icmp type-name \ - -Match based on icmp type-name. Use tab for information -about what **type-name** criteria are supported. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> inbound-interface name \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> inbound-interface name \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> inbound-interface name \ - -Match based on inbound interface. Wildcard ``*`` is supported. For example: -``eth2*``. Prepend the character ``!`` to invert the criteria. For example: -``!eth2`` -``` -:::{note} -If an interface is attached to a non-default vrf, when using -**inbound-interface**, the vrf name must be used. For example `set firewall -ipv4 forward filter rule 10 inbound-interface name MGMT` -::: -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> inbound-interface group \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> inbound-interface group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> inbound-interface group \ - -Match based on the inbound interface group. Prepend the character ``!`` to -invert the criteria. For example, ``!IFACE_GROUP`` -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> outbound-interface name \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> outbound-interface name \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> outbound-interface name \ - -Match based on outbound interface. Wildcard ``*`` is supported. For example: -``eth2*``. Prepend the character ``!`` to invert the criteria. For example: -``!eth2`` -``` -:::{note} -If an interface is attached to a non-default vrf, when using -**outbound-interface**, the real interface name must be used. For example -`set firewall ipv4 forward filter rule 10 outbound-interface name eth0` -::: -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> outbound-interface group \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> outbound-interface group \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> outbound-interface group \ - -Match based on outbound interface group. Prepend the character ``!`` to -invert the criteria. For example: ``!IFACE_GROUP`` -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> ipsec [match-ipsec-in | match-none-in] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> ipsec [match-ipsec-out | match-none-out] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] - -Match based on ipsec. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> limit burst \<0-4294967295\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> limit burst \<0-4294967295\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> limit burst \<0-4294967295\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> limit burst \<0-4294967295\> - -Match based on the maximum number of packets to allow in excess of rate. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> limit rate \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> limit rate \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> limit rate \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> limit rate \ - -Specify the maximum average rate as **integer/unit**. For example: -**5/minutes** -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> packet-length-exclude \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> packet-length-exclude \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> packet-length-exclude \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> packet-length-exclude \ - -Match based on packet length. Specify multiple values from 1 to 65535 and -ranges. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> packet-type [broadcast | host | multicast | other] - -Match based on the packet type. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] - -Match based on protocol number or name as defined in ``/etc/protocols``. -Special names are ``all`` for all protocols and ``tcp_udp`` for TCP and UDP -based packets. The ``!`` character negates the selected protocol. - -:::{code-block} none -set firewall ipv4 forward filter rule 10 protocol tcp_udp -set firewall ipv4 forward filter rule 11 protocol !tcp_udp -::: -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> recent time [second | minute | hour] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> recent time [second | minute | hour] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> recent time [second | minute | hour] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> recent time [second | minute | hour] - -Match based on recently seen sources. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> tcp flags [not] \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> tcp flags [not] \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> tcp flags [not] \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> tcp flags [not] \ - -Specify TCP flags. Allowed values are ``ack``, ``cwr``, ``ecn``, ``fin``, -``psh``, ``rst``, ``syn``, and ``urg``. Specify multiple values, and use -``not`` for inverted selection, as shown in the example. - -:::{code-block} none -set firewall ipv4 input filter rule 10 tcp flags 'ack' -set firewall ipv4 input filter rule 12 tcp flags 'syn' -set firewall ipv4 input filter rule 13 tcp flags not 'fin' -::: -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> state [established | invalid | new | related] -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> state [established | invalid | new | related] -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> state [established | invalid | new | related] -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> state [established | invalid | new | related] - -Match against the state of a packet. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> time weekdays \ -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> time weekdays \ -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> time weekdays \ -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> time weekdays \ - -Time to match the defined rule. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> ttl \ \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> ttl \ \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> ttl \ \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 name \ rule \<1-999999\> ttl \ \<0-255\> - -Match the time to live parameter, where 'eq' means 'equal', 'gt' means -'greater than', and 'lt' means 'less than'. -``` - -### Packet Modifications - -Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify -packets before sending them out. This feature provides more flexibility in -packet handling. - -```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set dscp \<0-63\> -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set dscp \<0-63\> -``` - -```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set dscp \<0-63\> - -Set a specific value of Differentiated Services Codepoint (DSCP). -``` - -```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set mark \<1-2147483647\> - -Set a specific packet mark value. -``` - -```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set tcp-mss \<500-1460\> -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set tcp-mss \<500-1460\> -``` - -```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set tcp-mss \<500-1460\> - -Set the TCP-MSS (TCP maximum segment size) for the connection. -``` - -```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> set ttl \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set ttl \<0-255\> -``` - -```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set ttl \<0-255\> - -Set the TTL (Time to Live) value. -``` - -```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> set connection-mark \<0-2147483647\> -``` - -```{cfgcmd} set firewall ipv4 output [filter | raw] rule \<1-999999\> set connection-mark \<0-2147483647\> - -Set connection mark value. -``` - -## Synproxy - -Synproxy connections - -```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> action synproxy -``` - -```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> protocol tcp -``` - -```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> synproxy tcp mss \<501-65535\> - - Set the TCP-MSS (maximum segment size) for the connection -``` - -```{cfgcmd} set firewall ipv4 [input | forward] filter rule \<1-999999\> synproxy tcp window-scale \<1-14\> - - Set the window scale factor for TCP window scaling -``` - -### Example synproxy - -Requirements to enable synproxy: - -- Traffic must be symmetric. -- Synproxy relies on syncookies and TCP timestamps, ensure these are enabled. -- Disable conntrack loose track option. - -```none -set system sysctl parameter net.ipv4.tcp_timestamps value '1' - -set system conntrack tcp loose disable - -set system conntrack ignore ipv4 rule 10 destination port '8080' - -set system conntrack ignore ipv4 rule 10 protocol 'tcp' - -set system conntrack ignore ipv4 rule 10 tcp flags syn - -set firewall global-options syn-cookies 'enable' - -set firewall ipv4 input filter rule 10 action 'synproxy' - -set firewall ipv4 input filter rule 10 destination port '8080' - -set firewall ipv4 input filter rule 10 inbound-interface name 'eth1' - -set firewall ipv4 input filter rule 10 protocol 'tcp' - -set firewall ipv4 input filter rule 10 synproxy tcp mss '1460' - -set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7' - -set firewall ipv4 input filter rule 1000 action 'drop' - -set firewall ipv4 input filter rule 1000 state invalid - -``` - -## Operation-mode Firewall - -### Rule-set overview - -```{opcmd} show firewall - -This will show you a basic firewall overview, for all rule-sets, not -only for IPv4. - -:::{code-block} none -vyos@vyos:~$ show firewall -Rulesets Information - ---------------------------------- -ipv4 Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ----------------------------- -20 accept all 0 0 ip saddr @N_TRUSTEDv4 accept -21 jump all 0 0 jump NAME_AUX -default accept all 0 0 - ---------------------------------- -ipv4 Firewall "input filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ------------------------- -10 accept all 156 14377 iifname != @I_LAN accept -default accept all 0 0 - ---------------------------------- -ipv4 Firewall "name AUX" - -Rule Action Protocol Packets Bytes Conditions ------- -------- ---------- --------- ------- -------------------------------------------- -10 accept icmp 0 0 meta l4proto icmp accept -20 accept udp 0 0 meta l4proto udp ip saddr @A_SERVERS accept -30 drop all 0 0 ip saddr != @A_SERVERS iifname "eth2" - ---------------------------------- -ipv4 Firewall "output filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------- -10 reject all 0 0 oifname @I_LAN -20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept -default accept all 72 9258 - ---------------------------------- -ipv6 Firewall "input filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ------------------------------- -10 accept all 0 0 ip6 saddr @N6_TRUSTEDv6 accept -default accept all 2 112 - -vyos@vyos:~$ -::: -``` - -```{opcmd} show firewall summary - -This shows you a summary of rule-sets and groups. - -:::{code-block} none -vyos@vyos:~$ show firewall summary -Ruleset Summary - -IPv6 Ruleset: - -Ruleset Hook Ruleset Priority Description --------------- -------------------- ------------------------- -forward filter -input filter -ipv6_name IPV6-VyOS_MANAGEMENT -ipv6_name IPV6-WAN_IN PUBLIC_INTERNET - -IPv4 Ruleset: - -Ruleset Hook Ruleset Priority Description --------------- ------------------ ------------------------- -forward filter -input filter -name VyOS_MANAGEMENT -name WAN_IN PUBLIC_INTERNET - -Firewall Groups - -Name Type References Members ------------------------ ------------------ ----------------------- ---------------- -PBX address_group WAN_IN-100 198.51.100.77 -SERVERS address_group WAN_IN-110 192.0.2.10 -WAN_IN-111 192.0.2.11 -WAN_IN-112 192.0.2.12 -WAN_IN-120 -WAN_IN-121 -WAN_IN-122 -SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 -WAN_IN-20 -PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 -PINGABLE_ADDRESSES address_group WAN_IN-170 192.168.5.2 -WAN_IN-171 -PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 -SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 -IPV6-WAN_IN-111 2001:db8::3 -IPV6-WAN_IN-112 2001:db8::4 -IPV6-WAN_IN-120 -IPV6-WAN_IN-121 -IPV6-WAN_IN-122 -SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 -IPV6-WAN_IN-20 -::: -``` - -```{opcmd} show firewall ipv4 [forward | input | output] filter -``` - -```{opcmd} show firewall ipv4 name \ - -This command will give an overview of a single rule-set. - -:::{code-block} none -vyos@vyos:~$ show firewall ipv4 input filter -Ruleset Information ---------------------------------- -IPv4 Firewall "input filter" -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ----------------------------------------- -5 jump all 0 0 iifname "eth2" jump NAME_VyOS_MANAGEMENT -default accept all -::: -``` - -```{opcmd} show firewall ipv4 [forward | input | output] filter rule \<1-999999\> -``` - -```{opcmd} show firewall ipv4 name \ rule \<1-999999\> - -This command gives an overview of a rule in a single rule-set, plus -information for default action. -``` -```none -vyos@vyos:~$show firewall ipv4 output filter rule 20 -Rule Information - ---------------------------------- -ipv4 Firewall "output filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------- -20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept -default accept all 286 47614 - -vyos@vyos:~$ -``` - -```{opcmd} show firewall statistics - -This will show you statistics of all rule-sets since the last boot. -``` - -### Show Firewall log - -```{opcmd} show log firewall - -``` -```{opcmd} show log firewall ipv4 -``` - -```{opcmd} show log firewall ipv4 [forward | input | output | name] -``` - -```{opcmd} show log firewall ipv4 [forward | input | output] filter -``` - -```{opcmd} show log firewall ipv4 name \ -``` - -```{opcmd} show log firewall ipv4 [forward | input | output] filter rule \ -``` - -```{opcmd} show log firewall ipv4 name \ rule \ - -Show the logs of all firewall; show all IPv4 firewall logs; show all logs -for particular hook; show all logs for particular hook and priority; -show all logs for particular custom chain; show logs for specific rule-set. -``` - -### Example Partial Config - -```none -firewall { - group { - network-group BAD-NETWORKS { - network 198.51.100.0/24 - network 203.0.113.0/24 - } - network-group GOOD-NETWORKS { - network 192.0.2.0/24 - } - port-group BAD-PORTS { - port 65535 - } - } - ipv4 { - forward { - filter { - default-action accept - rule 5 { - action accept - source { - group { - network-group GOOD-NETWORKS - } - } - } - rule 10 { - action drop - description "Bad Networks" - protocol all - source { - group { - network-group BAD-NETWORKS - } - } - } - } - } - } -} -``` - -### Update geoip database - -```{opcmd} update geoip - -Command to update GeoIP database and firewall sets. -``` \ No newline at end of file diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md deleted file mode 100644 index e9011b4c..00000000 --- a/docs/configuration/firewall/md-ipv6.md +++ /dev/null @@ -1,1567 +0,0 @@ ---- -lastproofread: '2026-04-01' ---- - -(firewall-ipv6-configuration)= - -# IPv6 Firewall Configuration - -## Overview - -This section covers useful information about IPv6 firewall configuration and -appropriate operation-mode commands. - -This section describes the following configuration commands: - -```{cfgcmd} set firewall ipv6 ... -``` - -To learn about the general traffic flow in VyOS firewalls, see {doc}`Firewall `. - -```none -- set firewall - * ipv6 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name -``` - -The router first receives all traffic and processes it in the **prerouting** -section. - - -This stage includes: - - -- **Firewall Prerouting**: commands found under `set firewall ipv6 - prerouting raw ...` -- {doc}`Conntrack Ignore`: `set system - conntrack ignore ipv6...` -- {doc}`Policy Route`: commands found under - `set policy route6 ...` -- {doc}`Destination NAT`: commands found under - `set nat66 destination ...` - - -For transit traffic that the router receives and forwards, the base chain is -**forward**. The following diagram shows a simplified packet flow for transit -traffic: - - -:::{figure} /_static/images/firewall-fwd-packet-flow.webp -::: - - -Use `set firewall ipv6 forward filter ...` to configure filtering rules for -transit traffic. This command corresponds to stage 5 and is highlighted in red -in the diagram. - - -For traffic destined to the router, use the **input** chain. For traffic the -router generates, use the **output** chain. The following diagram shows the -packet flow for traffic destined to the router and traffic generated by the -router (starting from circle number 6): - - -:::{figure} /_static/images/firewall-input-packet-flow.webp -::: - - -Use `set firewall ipv6 input filter ...` to configure traffic destined to -the router. - - -Use `set firewall ipv6 output ...` to configure traffic the router generates. -Two sub-chains are available: **filter** and **raw**: - - -- **Output Prerouting**: `set firewall ipv6 output raw ...`. - As described in **Prerouting**, the firewall processes rules in this - section before the connection tracking subsystem. -- **Output Filter**: `set firewall ipv6 output filter ...`. The firewall - processes rules in this section after the connection tracking subsystem. - - -:::{note} -**Important note about default-actions:** -If you do not define a default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop** -::: - - -Create custom firewall chains using the commands -`set firewall ipv6 name ...`. To use the custom chain, define a -rule with **action jump** and the appropriate **target** in a base chain. - - -## Firewall - IPv6 Rules - - -Create firewall rules for firewall filtering. Each rule is numbered and has -an action to apply when the rule is matched. You can specify multiple matching -criteria. Packets go through rules from 1 - 999999, so order is crucial. The -firewall executes the action of the first matching rule. - - -### Actions - - -If you define a rule, you must define an action for it. The action tells the -firewall what to do when all criteria for that rule are met. - - -The action can be : - - -- `accept`: accept the packet. -- `continue`: continue parsing next rule. -- `drop`: drop the packet. -- `reject`: reject the packet. -- `jump`: jump to another custom chain. -- `return`: Return from the current chain and continue at the next rule - of the last chain. -- `queue`: Enqueue packet to userspace. -- `synproxy`: synproxy the packet. - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> action [accept | continue | drop | jump | queue | reject | return] - -This required setting defines the action of the current rule. If you set -the action to jump, you must also define a jump-target. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> jump-target \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> jump-target \ - -Use this command only when action is set to ``jump``. Specify the jump -target. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> queue \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> queue \<0-65535\> - -Use this command only when action is set to ``queue``. Specify the queue -target. Queue ranges are also supported. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> queue-options bypass -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> queue-options bypass - -Use this command only when action is set to ``queue``. This command allows -the packet to go through the firewall when no userspace software is connected -to the queue. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> queue-options fanout -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> queue-options fanout - -Use this command only when action is set to ``queue``. This command -distributes packets among multiple queues. -``` - -Also, **default-action** is an action that takes place whenever a packet does -not match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -```{cfgcmd} set firewall ipv6 forward filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall ipv6 input filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall ipv6 output filter default-action [accept | drop] -``` - -```{cfgcmd} set firewall ipv6 name \ default-action [accept | drop | jump | queue | reject | return] - -Set the default action of the rule-set if a packet does not match any rule -criteria. If you set default-action to ``jump``, you must also define -``default-jump-target``. For base chains, you can only set the default -action to ``accept`` or ``drop``. For custom chains, more actions are -available. -``` - -```{cfgcmd} set firewall ipv6 name \ default-jump-target \ - -To be used only when ``default-action`` is set to ``jump``. Use this -command to specify the jump target for the default rule. -``` -:::{note} -**Important note about default-actions:** -If you do not define the default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop**. -::: - - -### Firewall Logs - - -You can enable logging for each firewall rule. When enabled, you can also -define other log options. - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log - -Enable logging for matched packets. If this configuration command is not -present, logging is disabled. -``` - -```{cfgcmd} set firewall ipv6 forward filter default-log -``` - -```{cfgcmd} set firewall ipv6 input filter default-log -``` - -```{cfgcmd} set firewall ipv6 output filter default-log -``` - -```{cfgcmd} set firewall ipv6 name \ default-log - -Use this command to enable the logging of the default action on -the specified chain. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options level [emerg | alert | crit | err | warn | notice | info | debug] - -Define log-level. Only applicable if rule log is enabled. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options group \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options group \<0-65535\> - -Define the log group to send messages to. Only applicable if rule log is -enabled. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options snapshot-length \<0-9000\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options snapshot-length \<0-9000\> - -Define the length of packet payload to include in a netlink message. Only -applicable when rule logging is enabled and log group is defined. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> log-options queue-threshold \<0-65535\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> log-options queue-threshold \<0-65535\> - -Define the number of packets to queue inside the kernel before sending them -to userspace. Only applicable when rule logging is enabled and log group is -defined. -``` - -### Firewall Description - - -For reference, you can define descriptions on every rule and custom chain. - -```{cfgcmd} set firewall ipv6 name \ description \ - -Provide a rule-set description to a custom firewall chain. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> description \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> description \ - -Provide a description for each rule. -``` - -### Rule Status - - -New rules are enabled by default. In some cases, you may want to disable a -rule rather than remove it. - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> disable -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> disable - -Command for disabling a rule but keep it in the configuration. -``` - -### Matching criteria - - -There are a lot of matching criteria against which the packet can be tested. - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> connection-status nat [destination | source] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> connection-status nat [destination | source] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> connection-status nat [destination | source] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> connection-status nat [destination | source] - -Match packets based on NAT connection status. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> connection-mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> connection-mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> connection-mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> connection-mark \<1-2147483647\> - -Match packets based on connection mark. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination address [address | addressrange | CIDR] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination address [address | addressrange | CIDR] - -Match based on source or destination address. This is similar to network -groups, but you can negate the matching addresses here. - -:::{code-block} none -set firewall ipv6 name FOO rule 100 source address 2001:db8::202 -::: -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source address-mask [address] -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination address-mask [address] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination address-mask [address] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination address-mask [address] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination address-mask [address] - -Apply an arbitrary netmask to mask addresses and match only a specific -portion. This is useful for IPv6 because rules remain valid when the IPv6 -prefix changes if the host portion of the system's IPv6 address is static. -Examples include SLAAC and tokenised IPv6 addresses - -This function works for both individual addresses and address groups. - - -:::{code-block} none -# Match any IPv6 address with the suffix ::0000:0000:0000:beef -set firewall ipv6 forward filter rule 100 destination address ::beef -set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff -# Address groups -set firewall group ipv6-address-group WEBSERVERS address ::1000 -set firewall group ipv6-address-group WEBSERVERS address ::2000 -set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS -set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff -::: -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source fqdn \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination fqdn \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination fqdn \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination fqdn \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination fqdn \ - -Specify a Fully Qualified Domain Name as source or destination to match. -Ensure that the router can resolve the DNS query. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination geoip country-code \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source geoip inverse-match -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination geoip inverse-match -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination geoip inverse-match -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination geoip inverse-match -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination geoip inverse-match - -Match IP addresses based on their geolocation. For more information, see -GeoIP matching. -Use inverse-match to match anything except the specified country codes. -``` - -DB-IP.com provides data under CC-BY-4.0 license. Attribution is required and -redistribution is permitted, allowing VyOS to include a database in images -(approximately 3 MB compressed). The package includes a cron script that you -can manually call through op-mode update geoip to keep the database and rules -updated. - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source mac-address \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source mac-address \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source mac-address \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source mac-address \ - -You can specify only a source MAC address to match. - -:::{code-block} none -set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33 -set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34 -::: -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination port [1-65535 | portname | start-end] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination port [1-65535 | portname | start-end] - -Specify a port by number or by name as defined in ``/etc/services``. - -:::{code-block} none -set firewall ipv6 forward filter rule 10 source port '22' -set firewall ipv6 forward filter rule 11 source port '!http' -set firewall ipv6 forward filter rule 12 source port 'https' -::: -Multiple source ports can be specified as a comma-separated list. -The whole list can also be "negated" using ``!``. For example: - -:::{code-block} none -set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338' -::: -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group address-group \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group address-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group address-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group address-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group address-group \ - -Specify an address group. You can prepend the character ``!`` to invert the -matching criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group dynamic-address-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group dynamic-address-group \ - -Specify a dynamic address group. You can prepend the character ``!`` to -invert the matching criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group network-group \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group network-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group network-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group network-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group network-group \ - -Specify a network group. You can prepend the character ``!`` to invert the -matching criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group port-group \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group port-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group port-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group port-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group port-group \ - -Specify a port group. You can prepend the character ``!`` to invert the -matching criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group domain-group \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group domain-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group domain-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group domain-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group domain-group \ - -Specify a domain group. You can prepend the character ``!`` to invert the -matching criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> source group mac-group \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> destination group mac-group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> destination group mac-group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> destination group mac-group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> destination group mac-group \ - -Specify a MAC group. You can prepend the character ``!`` to invert the -matching criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> dscp [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> dscp-exclude [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> dscp-exclude [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> dscp-exclude [0-63 | start-end] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> dscp-exclude [0-63 | start-end] - -Match based on dscp value. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> fragment [match-frag | match-non-frag] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> fragment [match-frag | match-non-frag] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> fragment [match-frag | match-non-frag] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> fragment [match-frag | match-non-frag] - -Match packets based on fragmentation. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> icmpv6 [code | type] \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> icmpv6 [code | type] \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> icmpv6 [code | type] \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> icmpv6 [code | type] \<0-255\> - -Match packets based on ICMP or ICMPv6 code and type. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> icmpv6 type-name \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> icmpv6 type-name \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> icmpv6 type-name \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> icmpv6 type-name \ - -Match based on ICMPv6 type-name. Press **Tab** for information about -supported **type-name** criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> inbound-interface name \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> inbound-interface name \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> inbound-interface name \ - -Match based on inbound interface. You can use the wildcard ``*``. For -example: ``eth2*``. You can prepend the character ``!`` to invert the -matching criteria. For example ``!eth2`` -``` -:::{note} -If an interface is attached to a non-default VRF, when using -**inbound-interface**, use the VRF name. For example: -`set firewall ipv6 forward filter rule 10 inbound-interface name MGMT` -::: -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> inbound-interface group \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> inbound-interface group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> inbound-interface group \ - -Match based on the inbound interface group. You can prepend the character -``!`` to invert the matching criteria. For example ``!IFACE_GROUP`` -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> outbound-interface name \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> outbound-interface name \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> outbound-interface name \ - -Match based on outbound interface. You can use the wildcard ``*``. For -example: ``eth2*``. You can prepend the character ``!`` to invert the -matching criteria. For example ``!eth2`` -``` -:::{note} -If an interface is attached to a non-default VRF, when using -**outbound-interface**, use the physical interface name. For example: -`set firewall ipv6 forward filter rule 10 outbound-interface name eth0` -::: -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> outbound-interface group \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> outbound-interface group \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> outbound-interface group \ - -Match based on outbound interface group. You can prepend the character ``!`` -to invert the matching criteria. For example ``!IFACE_GROUP`` -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> ipsec [match-ipsec-in | match-none-in] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> ipsec [match-ipsec-out | match-none-out] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] - -Match packets based on IPsec. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> limit burst \<0-4294967295\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> limit burst \<0-4294967295\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> limit burst \<0-4294967295\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> limit burst \<0-4294967295\> - -Match based on the maximum number of packets allowed to exceed the rate -limit. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> limit rate \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> limit rate \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> limit rate \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> limit rate \ - -Match based on the maximum average rate, specified as ``integer/unit``. -For example, specify ``5/minutes``. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> packet-length \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> packet-length-exclude \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> packet-length-exclude \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> packet-length-exclude \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> packet-length-exclude \ - -Match based on packet length. You can specify multiple values from 1 to -65535 and ranges. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> packet-type [broadcast | host | multicast | other] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> packet-type [broadcast | host | multicast | other] - -Match based on packet type. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> protocol [\ | \<0-255\> | all | tcp_udp] - -Match based on protocol number or name as defined in ``/etc/protocols``. -Specify ``all`` for all protocols and ``tcp_udp`` for TCP and UDP packets. -Prepend ``!`` to negate the protocol selection. - -:::{code-block} none -set firewall ipv6 input filter rule 10 protocol tcp -::: -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent time [second | minute | hour] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent time [second | minute | hour] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent time [second | minute | hour] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent time [second | minute | hour] - -Match packets based on recently seen sources. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> tcp flags [not] \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> tcp flags [not] \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> tcp flags [not] \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> tcp flags [not] \ - -Allowed values for TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``, -``rst``, ``syn``, and ``urg``. You can specify multiple values. To invert -the selection, use ``not``, as shown in the following example. - -:::{code-block} none -set firewall ipv6 input filter rule 10 tcp flags 'ack' -set firewall ipv6 input filter rule 12 tcp flags 'syn' -set firewall ipv6 input filter rule 13 tcp flags not 'fin' -::: -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> state [established | invalid | new | related] -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> state [established | invalid | new | related] -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> state [established | invalid | new | related] -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> state [established | invalid | new | related] - -Match based on packet state. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time startdate \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time starttime \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time stopdate \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time stoptime \ -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> time weekdays \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> time weekdays \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> time weekdays \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> time weekdays \ - -Match packets based on time criteria. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> hop-limit \ \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> hop-limit \ \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> hop-limit \ \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> hop-limit \ \<0-255\> - -Match the hop-limit parameter. Use ``eq`` for equal, ``gt`` for greater than, -and ``lt`` for less than. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent count \<1-255\> -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> recent time \ -``` - -```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> recent time \ -``` - -```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> recent time \ -``` - -```{cfgcmd} set firewall ipv6 name \ rule \<1-999999\> recent time \ - -Match when the specified number of connections occur within the specified -time period. Use these criteria to block brute-force attempts. -``` - -### Packet Modifications - - -The firewall can modify packets before sending them. -This feature provides more flexibility for packet handling. - -```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set dscp \<0-63\> -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set dscp \<0-63\> -``` - -```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set dscp \<0-63\> - -Set a specific value of Differentiated Services Codepoint (DSCP). -``` - -```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set mark \<1-2147483647\> -``` - -```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set mark \<1-2147483647\> - -Set a specific packet mark value. -``` - -```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set tcp-mss \<500-1460\> -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set tcp-mss \<500-1460\> -``` - -```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set tcp-mss \<500-1460\> - -Set the TCP-MSS (TCP maximum segment size) for the connection. -``` - -```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> set hop-limit \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set hop-limit \<0-255\> -``` - -```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set hop-limit \<0-255\> - -Set hop limit value. -``` - -```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> set connection-mark \<0-2147483647\> -``` - -```{cfgcmd} set firewall ipv6 output [filter | raw] rule \<1-999999\> set connection-mark \<0-2147483647\> - -Set connection mark value. -``` - -## Synproxy - - -Synproxy connections - -```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> action synproxy -``` - -```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> protocol tcp -``` - -```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> synproxy tcp mss \<501-65535\> - - Set the TCP MSS (maximum segment size) for the connection. -``` - -```{cfgcmd} set firewall ipv6 [input | forward] filter rule \<1-999999\> synproxy tcp window-scale \<1-14\> - - Set the window scale factor for TCP window scaling. -``` - -### Example synproxy - - -Requirements to enable synproxy: - - -- Traffic must be symmetric -- Synproxy relies on syncookies and TCP timestamps, ensure these are enabled -- Disable conntrack loose track option - -```none -set system sysctl parameter net.ipv4.tcp_timestamps value '1' - - -set system conntrack tcp loose disable - -set system conntrack ignore ipv6 rule 10 destination port '8080' - -set system conntrack ignore ipv6 rule 10 protocol 'tcp' - -set system conntrack ignore ipv6 rule 10 tcp flags syn - - -set firewall global-options syn-cookies 'enable' - -set firewall ipv6 input filter rule 10 action 'synproxy' - -set firewall ipv6 input filter rule 10 destination port '8080' - -set firewall ipv6 input filter rule 10 inbound-interface name 'eth1' - -set firewall ipv6 input filter rule 10 protocol 'tcp' - -set firewall ipv6 input filter rule 10 synproxy tcp mss '1460' - -set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7' - -set firewall ipv6 input filter rule 1000 action 'drop' - -set firewall ipv6 input filter rule 1000 state invalid - -``` - -## Operation-mode Firewall - - -### Rule-set overview - -```{opcmd} show firewall - -Show a basic firewall overview for all rule-sets, not only for IPv6: - -:::{code-block} none -vyos@vyos:~$ show firewall -Rulesets Information - ---------------------------------- -IPv4 Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ----------------------------------------- -5 jump all 0 0 iifname "eth1" jump NAME_VyOS_MANAGEMENT -10 jump all 0 0 oifname "eth1" jump NAME_WAN_IN -15 jump all 0 0 iifname "eth3" jump NAME_WAN_IN -default accept all - ---------------------------------- -IPv4 Firewall "name VyOS_MANAGEMENT" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- -------------------------------- -5 accept all 0 0 ct state established accept -10 drop all 0 0 ct state invalid -20 accept all 0 0 ip saddr @A_GOOD_GUYS accept -30 accept all 0 0 ip saddr @N_ENTIRE_RANGE accept -40 accept all 0 0 ip saddr @A_VyOS_SERVERS accept -50 accept icmp 0 0 meta l4proto icmp accept -default drop all 0 0 - ---------------------------------- -IPv6 Firewall "forward filter" - -Rule Action Protocol -------- -------- ---------- -5 jump all -10 jump all -15 jump all -default accept all - ---------------------------------- -IPv6 Firewall "input filter" - -Rule Action Protocol -------- -------- ---------- -5 jump all -default accept all - ---------------------------------- -IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT" - -Rule Action Protocol -------- -------- ---------- -5 accept all -10 drop all -20 accept all -30 accept all -40 accept all -50 accept ipv6-icmp -default drop all -::: -``` - -```{opcmd} show firewall summary - -This will show you a summary of rule-sets and groups - -:::{code-block} none -vyos@vyos:~$ show firewall summary -Ruleset Summary - -IPv6 Ruleset: - -Ruleset Hook Ruleset Priority Description --------------- -------------------- ------------------------- -forward filter -input filter -ipv6_name IPV6-VyOS_MANAGEMENT -ipv6_name IPV6-WAN_IN PUBLIC_INTERNET - -IPv4 Ruleset: - -Ruleset Hook Ruleset Priority Description --------------- ------------------ ------------------------- -forward filter -input filter -name VyOS_MANAGEMENT -name WAN_IN PUBLIC_INTERNET - -Firewall Groups - -Name Type References Members ------------------------ ------------------ ----------------------- ---------------- -PBX address_group WAN_IN-100 198.51.100.77 -SERVERS address_group WAN_IN-110 192.0.2.10 -WAN_IN-111 192.0.2.11 -WAN_IN-112 192.0.2.12 -WAN_IN-120 -WAN_IN-121 -WAN_IN-122 -SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 -WAN_IN-20 -PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 -PINGABLE_ADDRESSES address_group WAN_IN-170 192.168.5.2 -WAN_IN-171 -PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 -SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 -IPV6-WAN_IN-111 2001:db8::3 -IPV6-WAN_IN-112 2001:db8::4 -IPV6-WAN_IN-120 -IPV6-WAN_IN-121 -IPV6-WAN_IN-122 -SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 -IPV6-WAN_IN-20 -::: -``` - -```{opcmd} show firewall ipv6 [forward | input | output] filter -``` - -```{opcmd} show firewall ipv6 ipv6-name \ - -This command will give an overview of a single rule-set. - -:::{code-block} none -vyos@vyos:~$ show firewall ipv6 input filter -Ruleset Information - ---------------------------------- -ipv6 Firewall "input filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ------------------------------------------------------------------------------ -10 jump all 13 1456 iifname "eth1" jump NAME6_INP-ETH1 -20 accept ipv6-icmp 10 1112 meta l4proto ipv6-icmp iifname "eth0" prefix "[ipv6-INP-filter-20-A]" accept -default accept all 14 1584 - -vyos@vyos:~$ -::: -``` - -```{opcmd} show firewall ipv6 [forward | input | output] filter rule \<1-999999\> -``` - -```{opcmd} show firewall ipv6 name \ rule \<1-999999\> -``` - -```{opcmd} show firewall ipv6 ipv6-name \ rule \<1-999999\> - -This command will give an overview of a rule in a single rule-set -``` - -```{opcmd} show firewall group \ - -Show an overview of defined groups, including the type, members, and where -the group is used. - -:::{code-block} none -vyos@vyos:~$ show firewall group LAN -Firewall Groups - -Name Type References Members ------------- ------------------ ----------------------- ---------------- -LAN ipv6_network_group IPV6-VyOS_MANAGEMENT-30 2001:db8::0/64 -IPV6-WAN_IN-30 -LAN network_group VyOS_MANAGEMENT-30 192.168.200.0/24 -WAN_IN-30 -::: -``` - -```{opcmd} show firewall statistics - -Show statistics of all rule-sets since the last boot. -``` - -### Show Firewall log - -```{opcmd} show log firewall -``` - -```{opcmd} show log firewall ipv6 -``` - -```{opcmd} show log firewall ipv6 [forward | input | output | name] -``` - -```{opcmd} show log firewall ipv6 [forward | input | output] filter -``` - -```{opcmd} show log firewall ipv6 name \ -``` - -```{opcmd} show log firewall ipv6 [forward | input | output] filter rule \ -``` - -```{opcmd} show log firewall ipv6 name \ rule \ - -Show firewall logs for all firewalls, all IPv6 firewalls, specific hooks, -specific priorities, specific custom chains, or specific rule-sets. -``` - -### Example Partial Config - -```none -firewall { - ipv6 { - input { - filter { - rule 10 { - action jump - inbound-interface { - name eth1 - } - jump-target INP-ETH1 - } - rule 20 { - action accept - inbound-interface { - name eth0 - } - log - protocol ipv6-icmp - } - } - } - name INP-ETH1 { - default-action drop - default-log - rule 10 { - action accept - protocol tcp_udp - } - } - } -} -``` - -### Update geoip database - -```{opcmd} update geoip - -Command used to update GeoIP database and firewall sets. -``` \ No newline at end of file diff --git a/docs/configuration/firewall/md-zone.md b/docs/configuration/firewall/md-zone.md deleted file mode 100644 index bbb93993..00000000 --- a/docs/configuration/firewall/md-zone.md +++ /dev/null @@ -1,201 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-zone)= - -# Zone-Based Firewall - -## Overview - -:::{note} -All VyOS versions built after 2023-10-22 (VyOS 1.4 and 1.5) support -this feature. -::: - -This section provides information on firewall configuration for the -zone-based firewall. This section covers the following configuration -commands: - -```{cfgcmd} set firewall zone ... -``` - -To learn about the general traffic flow in VyOS firewalls, -see {doc}`Firewall `. - -```none -- set firewall - * zone - - custom_zone_name - + ... -``` - -In zone-based policy, you assign interfaces to zones and apply inspection -policy to traffic moving between zones. The firewall acts on traffic -according to rules. A zone is a group of interfaces that have similar -functions or features. It establishes the security borders of a network. -A zone defines a boundary where the system subjects traffic to policy -restrictions as it crosses to another region of a network. - -Key Points: -- A zone must be configured before you assign an interface to it, and you - can assign an interface to only a single zone. -- All traffic to and from an interface within a zone flows freely. -- Existing policies affect all traffic between zones. -- Traffic cannot flow between a zone member interface and any interface that - is not a zone member. -- You must define 2 separate firewalls to define traffic: one for each - direction. - -:::{note} -In {vytask}`T2199` the syntax of the zone configuration was changed. -The zone configuration moved from ``zone-policy zone `` to -``firewall zone ``. -::: - -## Configuration - -As an alternative to applying policy to an interface directly, you can -create a zone-based firewall to simplify configuration when multiple -interfaces belong to the same security zone. Instead of applying rule-sets -to interfaces, you apply them to source-destination zone pairs. - -You can find a basic introduction to zone-based firewalls in the -[VyOS Knowledge Base](https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall), -and an example at {ref}`examples-zone-policy`. - -The following steps are required to create a zone-based firewall: -1. Define both the source and destination zones -2. Define the rule-set -3. Apply the rule-set to the zones - -### Define a Zone - -To define a zone, set up either one with interfaces or as the local zone. - -```{cfgcmd} set firewall zone \ interface \ - -Assign interfaces as a member of a zone. - -:::{note} -* An interface can only be a member of one zone. -* You can have multiple interfaces in a zone. Traffic between -interfaces in the same zone follows the intra-zone-filtering -policy (allowed by default). -::: -``` - -```{cfgcmd} set firewall zone \ local-zone - -Define the zone as the local zone for traffic that originates from or is -destined to the router itself. - -:::{note} -* A local zone cannot have any member interfaces -* You cannot have multiple local zones -::: -``` - -```{cfgcmd} set firewall zone \ default-action [drop | reject] - -Modify the zone default-action, which applies to traffic destined to this -zone that does not match any of the source zone rulesets applied. -``` - -```{cfgcmd} set firewall zone \ default-log - -Enable logging of packets that match this zone's default-action (disabled -by default). -``` - -```{cfgcmd} set firewall zone \ description - -Add a meaningful description. -``` - -### Defining a Rule-Set - -Zone-based firewall rule-sets define traffic from a *Source Zone* to a -*Destination Zone*. - -You create rule-sets as a custom firewall chain using the commands below -(refer to the firewall IPv4/IPv6 sections for the full syntax): -- For {ref}`IPv4`: - `set firewall ipv4 name ...` -- For {ref}`IPv6`: - `set firewall ipv6 name ...` - -It is helpful to name the rule-sets in the format -`--` to make them easily -identifiable. - -### Applying a Rule-Set to a Zone - -After you define a rule-set, apply it to the source and destination zones. -The configuration syntax anchors to the destination zone, with each of the -source zone rule-sets listed against the destination. - -```{cfgcmd} set firewall zone \ from \ firewall name \ -``` - -```{cfgcmd} set firewall zone \ from \ firewall ipv6-name \ -``` - -You should create two rule-sets for each source-destination zone -pair. - -```none -set firewall zone DMZ from LAN firewall name LAN-DMZ-v4 -set firewall zone LAN from DMZ firewall name DMZ-LAN-v4 -``` - -### Applying a Default Rule-Set to a Zone - -When a destination zone shares a common rule-set for multiple source zones, -or when you require a complex set of default policies, you can apply an -optional default rule-set. The default rule-set applies to all zones that do -not have a rule-set configured as defined in -{ref}`IPv4` - -```{cfgcmd} set firewall zone \ default-firewall name \ -``` - -```{cfgcmd} set firewall zone \ default-firewall ipv6-name \ -``` - -## Operation-mode - -```{opcmd} show firewall zone-policy - -Display a basic summary of the zone configuration. - -:::{code-block} none -vyos@vyos:~$ show firewall zone-policy -Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 ------- ------------ ----------- --------------- --------------- -LAN eth1 WAN WAN-LAN-v4 -eth2 -LOCAL LOCAL LAN LAN-LOCAL-v4 -WAN WAN-LOCAL-v4 WAN-LOCAL-v6 -WAN eth3 LAN LAN-WAN-v4 -eth0 LOCAL LOCAL-WAN-v4 -::: -``` - -```{opcmd} show firewall zone-policy zone \ - -Display a basic summary of a particular zone. - -:::{code-block} none -vyos@vyos:~$ show firewall zone-policy zone WAN -Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 ------- ------------ ----------- --------------- --------------- -WAN eth3 LAN LAN-WAN-v4 -eth0 LOCAL LOCAL-WAN-v4 -vyos@vyos:~$ show firewall zone-policy zone LOCAL -Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 ------- ------------ ----------- --------------- --------------- -LOCAL LOCAL LAN LAN-LOCAL-v4 -WAN WAN-LOCAL-v4 WAN-LOCAL-v6 -::: -``` \ No newline at end of file diff --git a/docs/configuration/firewall/rst-bridge.rst b/docs/configuration/firewall/rst-bridge.rst new file mode 100644 index 00000000..53775514 --- /dev/null +++ b/docs/configuration/firewall/rst-bridge.rst @@ -0,0 +1,573 @@ +:lastproofread: 2026-03-28 + +.. _firewall-configuration: + +############################# +Bridge Firewall Configuration +############################# + +******** +Overview +******** + +Learn more about bridge firewall configuration +and related op-mode commands. + +The following commands are covered in this section: + +.. cfgcmd:: set firewall bridge + +From the main structure defined in +:doc:`Firewall Overview` +in this section you can find detailed information only for the next part +of the general structure: + +.. code-block:: none + + - set firewall + * bridge + - forward + + filter + - input + + filter + - output + + filter + - prerouting + + filter + - name + + custom_name + +Traffic that is received by the router on an interface that is a member of a +bridge is processed on the **Bridge Layer**. Before the bridge decision is +made, all packets are analyzed at **Prerouting**. First filters can be applied +here, and also rules for ignoring connection tracking system can be configured. +The relevant configuration that acts in **prerouting** is: + + * ``set firewall bridge prerouting filter ...``. + +For traffic that needs to be switched internally by the bridge, the base +chain is **forward**, and its base command for filtering is ``set firewall +bridge forward filter ...``, which happens in stage 4, highlighted with red +color. + +.. figure:: /_static/images/firewall-bridge-forward.* + +For traffic destined to the router itself or that needs to be routed +(assuming a layer3 bridge is configured), the base chain is **input**, and the +base command is ``set firewall bridge input filter ...`` and the path is: + +.. figure:: /_static/images/firewall-bridge-input.* + +If it's not dropped, then the packet is sent to **IP Layer**, and will be +processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again +the :doc:`general packet flow diagram` if +needed. + +For traffic that originates from the bridge itself, the base chain is +**output**, and the base command is ``set firewall bridge output filter +...``, and the path is: + +.. figure:: /_static/images/firewall-bridge-output.* + +Custom bridge firewall chains can be created with the command ``set firewall +bridge name ...``. To use such a custom chain, a rule with action jump +and the appropriate target must be defined in a base chain. + +************ +Bridge Rules +************ + +For firewall filtering, firewall rules need to be created. Each rule is +numbered, has an action to apply if the rule is matched, and the ability +to specify multiple matching criteria. Data packets go through the rules +from 1 - 999999, so order is crucial. At the first match the action of the +rule will be executed. + +Actions +======= + +If a rule is defined, an action must also be defined for it. This tells the +firewall what to do if all matching criteria in the rule are met. + +In firewall bridge rules, the action can be: + + * ``accept``: accept the packet. + + * ``continue``: continue parsing next rule. + + * ``drop``: drop the packet. + + * ``jump``: jump to another custom chain. + + * ``return``: Return from the current chain and continue at the next rule + of the last chain. + + * ``queue``: Enqueue packet to userspace. + + * ``notrack``: ignore connection tracking system. This action is only + available in prerouting chain. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> action + [accept | continue | drop | jump | queue | return] +.. cfgcmd:: set firewall bridge input filter rule <1-999999> action + [accept | continue | drop | jump | queue | return] +.. cfgcmd:: set firewall bridge output filter rule <1-999999> action + [accept | continue | drop | jump | queue | return] +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> action + [accept | continue | drop | jump | notrack | queue | return] +.. cfgcmd:: set firewall bridge name rule <1-999999> action + [accept | continue | drop | jump | queue | return] + + This required setting defines the action of the current rule. If action is + set to jump, then jump-target is also needed. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall bridge name rule <1-999999> + jump-target + + If action is set to ``queue``, use next command to specify the queue + target. Range is also supported: + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall bridge name rule <1-999999> + queue <0-65535> + + Also, if action is set to ``queue``, use next command to specify the queue + options. Possible options are ``bypass`` and ``fanout``: + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall bridge name rule <1-999999> + queue-options bypass + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall bridge name rule <1-999999> + queue-options fanout + +Also, **default-action** is an action that takes place whenever a packet does +not match any rule in its chain. For base chains, possible options for +**default-action** are **accept** or **drop**. + +.. cfgcmd:: set firewall bridge forward filter default-action + [accept | drop] +.. cfgcmd:: set firewall bridge input filter default-action + [accept | drop] +.. cfgcmd:: set firewall bridge output filter default-action + [accept | drop] +.. cfgcmd:: set firewall bridge prerouting filter default-action + [accept | drop] +.. cfgcmd:: set firewall bridge name default-action + [accept | continue | drop | jump | reject | return] + + This sets the default action of the rule-set if a packet does not match + any of the rules in that chain. If default-action is set to ``jump``, then + ``default-jump-target`` is also needed. Note that for base chains, default + action can only be set to ``accept`` or ``drop``, while on custom chains + more actions are available. + +.. cfgcmd:: set firewall bridge name default-jump-target + + To be used only when ``default-action`` is set to ``jump``. Use this + command to specify jump target for default rule. + +.. note:: **Important note about default-actions:** + If the default action for any base chain is not defined, then the default + action is set to **accept** for that chain. For custom chains, if the + default action is not defined, then the default-action is set to **drop**. + +Firewall Logs +============= + +You can enable logging for every firewall rule. If enabled, other log options +can be configured. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> log +.. cfgcmd:: set firewall bridge input filter rule <1-999999> log +.. cfgcmd:: set firewall bridge output filter rule <1-999999> log +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> log +.. cfgcmd:: set firewall bridge name rule <1-999999> log + + Enable logging for the matched packet. If this configuration command is not + present, then the log is not enabled. + +.. cfgcmd:: set firewall bridge forward filter default-log +.. cfgcmd:: set firewall bridge input filter default-log +.. cfgcmd:: set firewall bridge output filter default-log +.. cfgcmd:: set firewall bridge prerouting filter default-log +.. cfgcmd:: set firewall bridge name default-log + + Use this command to enable the logging of the default action on + the specified chain. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall bridge name rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] + + Define log-level. Only applicable if rule log is enabled. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall bridge name rule <1-999999> + log-options group <0-65535> + + Define the log group to send messages to. Only applicable if rule log is + enabled. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall bridge name rule <1-999999> + log-options snapshot-length <0-9000> + + Define length of packet payload to include in netlink message. Only + applicable if rule log is enabled and the log group is defined. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall bridge name rule <1-999999> + log-options queue-threshold <0-65535> + + Define the number of packets to queue inside the kernel before sending them + to userspace. Only applicable if rule log is enabled and the log group is + defined. + +Firewall Description +==================== + +You can define a description for reference for every custom chain. + +.. cfgcmd:: set firewall bridge name description + + Provide a rule-set description to a custom firewall chain. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> + description +.. cfgcmd:: set firewall bridge input filter rule <1-999999> + description +.. cfgcmd:: set firewall bridge output filter rule <1-999999> + description +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> + description +.. cfgcmd:: set firewall bridge name rule <1-999999> + description + + Provide a description for each rule. + +Rule Status +=========== + +By default, when you define a rule, it is enabled. In some cases, it is +useful to disable the rule instead of removing it. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> disable +.. cfgcmd:: set firewall bridge input filter rule <1-999999> disable +.. cfgcmd:: set firewall bridge output filter rule <1-999999> disable +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> disable +.. cfgcmd:: set firewall bridge name rule <1-999999> disable + + Command for disabling a rule but keep it in the configuration. + +Matching criteria +================= + +There are many matching criteria against which a packet can be tested. Refer +to :doc:`IPv4` and +:doc:`IPv6` matching criteria for more details. + +Since bridges operate at layer 2, both matchers for IPv4 and IPv6 are +supported in bridge firewall configuration. Same applies to firewall groups. + +Same specific matching criteria that can be used in bridge firewall are +described in this section: + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> ethernet-type + [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge input filter rule <1-999999> ethernet-type + [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge output filter rule <1-999999> ethernet-type + [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> ethernet-type + [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge name rule <1-999999> ethernet-type + [802.1q | 802.1ad | arp | ipv4 | ipv6] + + Match based on the Ethernet type of the packet. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan + ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan + ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan + ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan + ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] +.. cfgcmd:: set firewall bridge name rule <1-999999> vlan + ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] + + Match based on the Ethernet type of the packet when it is VLAN tagged. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan id + <0-4096> +.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan id + <0-4096> +.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan id + <0-4096> +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan id + <0-4096> +.. cfgcmd:: set firewall bridge name rule <1-999999> vlan id + <0-4096> + + Match based on VLAN identifier. Range is also supported. + +.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan priority + <0-7> +.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan priority + <0-7> +.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan priority + <0-7> +.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan priority + <0-7> +.. cfgcmd:: set firewall bridge name rule <1-999999> vlan priority + <0-7> + + Match based on VLAN priority (Priority Code Point - PCP). Range is also + supported. + +Packet Modifications +==================== + +Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify +packets before they are sent out. This feaure provides more flexibility in +packet handling. + +.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter + rule <1-999999> set dscp <0-63> + + Set a specific value of Differentiated Services Codepoint (DSCP). + +.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter + rule <1-999999> set mark <1-2147483647> + + Set a specific packet mark value. + +.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter + rule <1-999999> set tcp-mss <500-1460> + + Set the TCP-MSS (TCP maximum segment size) for the connection. + +.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter + rule <1-999999> set ttl <0-255> + + Set the TTL (Time to Live) value. + +.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter + rule <1-999999> set hop-limit <0-255> + + Set hop limit value. + +.. cfgcmd:: set firewall bridge [forward | output] filter + rule <1-999999> set connection-mark <0-2147483647> + + Set connection mark value. + + +Use IP firewall +=============== + +By default, for switched traffic, only the rules defined under ``set firewall +bridge`` are applied. There are two global-options that can be configured in +order to force deeper analysis of the packet on the IP layer. These options +are: + +.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv4 + + This command enables the IPv4 firewall for bridged traffic. If this option + is used, packets are also parsed by rules defined in ``set firewall ipv4 + ...`` + +.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv6 + + This command enables the IPv6 firewall for bridged traffic. If this option + is used, packets are also parsed by rules defined in ``set firewall ipv6 + ...`` + +*********************** +Operation-mode Firewall +*********************** + +Rule-set overview +================= + +In this section you can find all useful firewall op-mode commands. + +General commands for firewall configuration, counter and statistics: + +.. opcmd:: show firewall +.. opcmd:: show firewall summary +.. opcmd:: show firewall statistics + +And, to print only bridge firewall information: + +.. opcmd:: show firewall bridge +.. opcmd:: show firewall bridge forward filter +.. opcmd:: show firewall bridge forward filter rule +.. opcmd:: show firewall bridge name +.. opcmd:: show firewall bridge name rule + +Show Firewall log +================= + +.. opcmd:: show log firewall +.. opcmd:: show log firewall bridge +.. opcmd:: show log firewall bridge forward +.. opcmd:: show log firewall bridge forward filter +.. opcmd:: show log firewall bridge name +.. opcmd:: show log firewall bridge forward filter rule +.. opcmd:: show log firewall bridge name rule + + Show the logs of all firewall; show all bridge firewall logs; show all logs + for forward hook; show all logs for forward hook and priority filter; show + all logs for particular custom chain; show logs for specific Rule-Set. + +Example +======= + +Configuration example: + +.. code-block:: none + + set firewall bridge forward filter default-action 'drop' + set firewall bridge forward filter default-log + set firewall bridge forward filter rule 10 action 'continue' + set firewall bridge forward filter rule 10 inbound-interface name 'eth2' + set firewall bridge forward filter rule 10 vlan id '22' + set firewall bridge forward filter rule 20 action 'drop' + set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT' + set firewall bridge forward filter rule 20 vlan id '60' + set firewall bridge forward filter rule 30 action 'jump' + set firewall bridge forward filter rule 30 jump-target 'TEST' + set firewall bridge forward filter rule 30 outbound-interface name '!eth1' + set firewall bridge forward filter rule 35 action 'accept' + set firewall bridge forward filter rule 35 vlan id '11' + set firewall bridge forward filter rule 40 action 'continue' + set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11' + set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66' + set firewall bridge name TEST default-action 'accept' + set firewall bridge name TEST default-log + set firewall bridge name TEST rule 10 action 'continue' + set firewall bridge name TEST rule 10 log + set firewall bridge name TEST rule 10 vlan priority '0' + +And op-mode commands: + +.. code-block:: none + + vyos@BRI:~$ show firewall bridge + Rulesets bridge Information + + --------------------------------- + bridge Firewall "forward filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- --------------------------------------------------------------------- + 10 continue all 0 0 iifname "eth2" vlan id 22 continue + 20 drop all 0 0 iifname @I_TRUNK-RIGHT vlan id 60 + 30 jump all 2130 170688 oifname != "eth1" jump NAME_TEST + 35 accept all 2080 168616 vlan id 11 accept + 40 continue all 0 0 ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66 continue + default drop all 0 0 + + --------------------------------- + bridge Firewall "name TEST" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- -------------------------------------------------- + 10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue + default accept all 2130 170688 + + vyos@BRI:~$ + vyos@BRI:~$ show firewall bridge name TEST + Ruleset Information + + --------------------------------- + bridge Firewall "name TEST" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- -------------------------------------------------- + 10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue + default accept all 2130 170688 + + vyos@BRI:~$ + +Inspect logs: + +.. stop_vyoslinter + +.. code-block:: none + + vyos@BRI:~$ show log firewall bridge + Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 + Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 + Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 + ... + vyos@BRI:~$ show log firewall bridge forward filter + Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 + Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 + +.. start_vyoslinter diff --git a/docs/configuration/firewall/rst-flowtables.rst b/docs/configuration/firewall/rst-flowtables.rst new file mode 100644 index 00000000..f996a59e --- /dev/null +++ b/docs/configuration/firewall/rst-flowtables.rst @@ -0,0 +1,188 @@ +:lastproofread: 2026-03-30 + +.. _firewall-flowtables-configuration: + +################################# +Flowtables Firewall Configuration +################################# + +.. include:: /_include/need_improvement.txt + +******** +Overview +******** + +This section provides information on firewall configuration for flowtables. + +.. cfgcmd:: set firewall flowtable ... + +To learn about the general traffic flow in VyOS firewalls, +see :doc:`Firewall `. + +.. code-block:: none + + - set firewall + * flowtable + - custom_flow_table + + ... + + +Flowtables let you define a fastpath through the flowtable datapath. +Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP) +protocols. + +.. figure:: /_static/images/firewall-flowtable-packet-flow.* + +After the first packet successfully traverses the IP forwarding path (black +circles path), you can offload subsequent packets to the flowtable through your +ruleset. You specify when to add a flow to the flowtable during forward +filtering (red circle number 6). + +When a packet finds a matching entry in the flowtable (flowtable hit), the +system transmits it to the output netdevice. This means packets bypass the +classic IP forwarding path and use the **Fast Path** (orange circles path). +As a result, you do not see these packets from any Netfilter hooks after +ingress. If no matching entry exists in the flowtable (flowtable miss), the +packet traverses the classic IP forwarding path. + +.. note:: **Flowtable Reference:** + https://docs.kernel.org/networking/nf_flowtable.html + + +*********************** +Flowtable Configuration +*********************** + +To use flowtables, you need to configure the following: + + * Create a flowtable that includes the interfaces + that are going to be used by the flowtable. + + * Create a firewall rule. Set the action to + ``offload`` and use your desired flowtable for ``offload-target``. + +Creating a flow table: + +.. cfgcmd:: set firewall flowtable interface + + Specify interfaces to use in the flowtable. + +.. cfgcmd:: set firewall flowtable description + +Provide a description for the flow table. + +.. cfgcmd:: set firewall flowtable offload + + + Specify the offload type the flowtable uses: ``hardware`` or + ``software``. The default is ``software`` offload. + +.. note:: **Hardware offload**: Make sure your network interface controller + (NIC) supports hardware offloading and that you have the necessary drivers + installed before enabling this option. + +Creating rules for using flow tables: + +.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999> + action offload + + Create a firewall rule in the forward chain with the action set to + ``offload``. + +.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999> + offload-target + + Create a firewall rule in the forward chain and specify which flowtable + to use. Only applicable if the action is ``offload``. + +********************* +Configuration Example +********************* + +Consider the following in this setup: + + * This example uses two interfaces in the flowtables: ``eth0`` and ``eth1``. + + * The example provides a minimal firewall ruleset with filtering rules + and rules for using flowtable offload capabilities. + +The first packet is evaluated by the firewall path, so a +desired connection should be explicitly accepted. +The same should occur for traffic in reverse order. +In most cases, state policies are +used to accept a connection in the reverse path. + +In the following example only traffic coming from interface ``eth0``, +TCP protocol, and destination port 1122 is accepted. +All other traffic to the router is dropped. + +Commands +-------- + +.. code-block:: none + + set firewall flowtable FT01 interface 'eth0' + set firewall flowtable FT01 interface 'eth1' + set firewall ipv4 forward filter default-action 'drop' + set firewall ipv4 forward filter rule 10 action 'offload' + set firewall ipv4 forward filter rule 10 offload-target 'FT01' + set firewall ipv4 forward filter rule 10 state 'established' + set firewall ipv4 forward filter rule 10 state 'related' + set firewall ipv4 forward filter rule 20 action 'accept' + set firewall ipv4 forward filter rule 20 state 'established' + set firewall ipv4 forward filter rule 20 state 'related' + set firewall ipv4 forward filter rule 110 action 'accept' + set firewall ipv4 forward filter rule 110 destination address '192.0.2.100' + set firewall ipv4 forward filter rule 110 destination port '1122' + set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0' + set firewall ipv4 forward filter rule 110 protocol 'tcp' + +Explanation +----------- + +Here's what happens for a desired connection: + + 1. A packet arrives on ``eth0`` with destination address ``192.0.2.100``, TCP + protocol, and destination port 1122. Assume this address is reachable + through interface ``eth1``. + + 2. For this first packet, the connection state is **new**. Neither rule 10 + nor rule 20 applies. + + 3. Rule 110 matches, so the connection is accepted. + + 4. When the server 192.0.2.100 replies, the connection state becomes + **established**, and rule 20 accepts the reply. + + 5. The router receives the second packet for this connection. Because the + connection state is **established**, rule 10 matches and adds a new + entry in the flowtable FT01 for this connection. + + 6. Subsequent packets skip the traditional path and use the **Fast Path** + for offloading. + +Checks +------ + +Check the conntrack table to verify that the system accepted and properly +offloaded connections. + +.. code-block:: none + + vyos@FlowTables:~$ show firewall ipv4 forward filter + Ruleset Information + + --------------------------------- + ipv4 Firewall "forward filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------------------------------------------------- + 10 offload all 8 468 ct state { established, related } flow add @VYOS_FLOWTABLE_FT01 + 20 accept all 8 468 ct state { established, related } accept + 110 accept tcp 2 120 ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0" accept + default drop all 7 420 + + vyos@FlowTables:~$ sudo conntrack -L | grep tcp + conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown. + tcp 6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2 + vyos@FlowTables:~$ diff --git a/docs/configuration/firewall/rst-global-options.rst b/docs/configuration/firewall/rst-global-options.rst new file mode 100644 index 00000000..8eec5c3f --- /dev/null +++ b/docs/configuration/firewall/rst-global-options.rst @@ -0,0 +1,182 @@ +:lastproofread: 2026-03-30 + +.. _firewall-global-options-configuration: + +##################################### +Global Options Firewall Configuration +##################################### + +******** +Overview +******** + +Some firewall settings are global and affect the entire system. This section +provides information about these global options that you can configure using +the VyOS CLI. + +Configuration commands covered in this section: + +.. cfgcmd:: set firewall global-options ... + +************* +Configuration +************* + +.. cfgcmd:: set firewall global-options all-ping [enable | disable] + + By default, when VyOS receives an ICMP echo request packet destined for + itself, it answers with an ICMP echo reply, unless your firewall prevents + it. + + You can set firewall rules to accept, drop, or reject ICMP in, out, or + local traffic. You can also use the **firewall global-options all-ping** + command. This command affects only LOCAL traffic (packets destined for your + VyOS system), not IN or OUT traffic. + + .. note:: **firewall global-options all-ping** affects only LOCAL traffic + and always behaves in the most restrictive way + + .. code-block:: none + + set firewall global-options all-ping enable + + When you set this command, VyOS answers every ICMP echo request addressed + to itself, but that response occurs only if no other rule drops or rejects + local echo requests. In case of conflict, VyOS does not answer ICMP echo + requests. + + .. code-block:: none + + set firewall global-options all-ping disable + + When you set this command, VyOS answers no ICMP echo requests addressed to + itself, regardless of where they come from or what specific rules accept + them. + +.. cfgcmd:: set firewall global-options apply-to-bridged-traffic [ipv4 | ipv6] + + Apply IPv4 or IPv6 firewall rules to bridged traffic. + +.. cfgcmd:: set firewall global-options broadcast-ping [enable | disable] + + Enable or disable the response to ICMP broadcast messages. The system + alters the following parameter: + + * ``net.ipv4.icmp_echo_ignore_broadcasts`` + +.. cfgcmd:: set firewall global-options ip-src-route [enable | disable] +.. cfgcmd:: set firewall global-options ipv6-src-route [enable | disable] + + Set whether VyOS accepts packets with a source route option. + The following sysctl parameters will be changed: + + * ``net.ipv4.conf.all.accept_source_route`` + * ``net.ipv6.conf.all.accept_source_route`` + +.. cfgcmd:: set firewall global-options receive-redirects [enable | disable] +.. cfgcmd:: set firewall global-options ipv6-receive-redirects + [enable | disable] + + Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages. + The following sysctl parameters will be changed: + + * ``net.ipv4.conf.all.accept_redirects`` + * ``net.ipv6.conf.all.accept_redirects`` + +.. cfgcmd:: set firewall global-options send-redirects [enable | disable] + + Allow VyOS to send ICMPv4 redirect messages. + The following sysctl parameter will be changed: + + * ``net.ipv4.conf.all.send_redirects`` + +.. cfgcmd:: set firewall global-options log-martians [enable | disable] + + Allow VyOS to log martian IPv4 packets. + The following sysctl parameter will be changed: + + * ``net.ipv4.conf.all.log_martians`` + +.. cfgcmd:: set firewall global-options source-validation + [strict | loose | disable] + + Set the IPv4 source validation mode. + The following sysctl parameter will be changed: + + * ``net.ipv4.conf.all.rp_filter`` + +.. cfgcmd:: set firewall global-options syn-cookies [enable | disable] + + Allow VyOS to use IPv4 TCP SYN Cookies. + The following sysctl parameter will be changed: + + * ``net.ipv4.tcp_syncookies`` + +.. cfgcmd:: set firewall global-options twa-hazards-protection + [enable | disable] + + Enable or disable VyOS :rfc:`1337` conformance. + The following sysctl parameter will be changed: + + * ``net.ipv4.tcp_rfc1337`` + +.. cfgcmd:: set firewall global-options state-policy established action + [accept | drop | reject] + +.. cfgcmd:: set firewall global-options state-policy established log + +.. cfgcmd:: set firewall global-options state-policy established log-level + [emerg | alert | crit | err | warn | notice | info | debug] + + Set the global setting for an established connection. + +.. cfgcmd:: set firewall global-options state-policy invalid action + [accept | drop | reject] + +.. cfgcmd:: set firewall global-options state-policy invalid log + +.. cfgcmd:: set firewall global-options state-policy invalid log-level + [emerg | alert | crit | err | warn | notice | info | debug] + + Set the global setting for invalid packets. + +.. cfgcmd:: set firewall global-options state-policy related action + [accept | drop | reject] + +.. cfgcmd:: set firewall global-options state-policy related log + +.. cfgcmd:: set firewall global-options state-policy related log-level + [emerg | alert | crit | err | warn | notice | info | debug] + + Set the global setting for related connections. + +VyOS supports setting timeouts for connections by connection type. You can +set timeout values for generic connections, ICMP connections, UDP +connections, or TCP connections in various states. + +.. cfgcmd:: set firewall global-options timeout icmp <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout other <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp close <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp close-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp established <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp fin-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp last-ack <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp syn-recv <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp syn-sent <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout tcp time-wait <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout udp other <1-21474836> + :defaultvalue: +.. cfgcmd:: set firewall global-options timeout udp stream <1-21474836> + :defaultvalue: + + Set the timeout in seconds for a protocol or state. \ No newline at end of file diff --git a/docs/configuration/firewall/rst-groups.rst b/docs/configuration/firewall/rst-groups.rst new file mode 100644 index 00000000..9d29866e --- /dev/null +++ b/docs/configuration/firewall/rst-groups.rst @@ -0,0 +1,457 @@ +:lastproofread: 2026-03-30 + +.. _firewall-groups-configuration: + +############### +Firewall groups +############### + +************* +Configuration +************* + +Firewall groups represent collections of IP addresses, networks, ports, +MAC addresses, domains, or interfaces. You can reference a group in firewall, +NAT, and policy route rules as either a source or destination matcher, and/or +as inbound or outbound in the case of interface groups. + +Address Groups +============== + +An **address group** contains a single IP address or IP address range. + +.. cfgcmd:: set firewall group address-group address [address | + address range] +.. cfgcmd:: set firewall group ipv6-address-group address
+ + Define an IPv4 or IPv6 address group. + + .. code-block:: none + + set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1 + set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8 + set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1 + +.. cfgcmd:: set firewall group address-group description +.. cfgcmd:: set firewall group ipv6-address-group description + + Provide an IPv4 or IPv6 address group description. + +Remote Groups +============== + +A **remote-group** uses a URL that hosts a newline-delimited list of IPv4 +and/or IPv6 addresses, CIDRs, and ranges. VyOS pulls this list periodically +according to the frequency you define in the firewall **resolver-interval** +and loads matching entries into the group for use in rules. The list is cached +in persistent storage, so rules continue to function if updates fail. + +.. cfgcmd:: set firewall group remote-group url + + Specify a remote list of IPv4 and/or IPv6 addresses, ranges, and CIDRs + to fetch. + +.. cfgcmd:: set firewall group remote-group description + + Set a description for a remote group. + +The remote list format is flexible. VyOS attempts to parse the first word of +each line as an entry and skips lines it cannot match. Lines that begin with +an alphanumeric character but do not match valid IPv4 or IPv6 addresses, +ranges, or CIDRs are logged to the system log. The following examples show +acceptable formats that VyOS parses correctly: + +.. code-block:: none + + 127.0.0.1 + 127.0.0.0/24 + 127.0.0.1-127.0.0.254 + 2001:db8::1 + 2001:db8:cafe::/48 + 2001:db8:cafe::1-2001:db8:cafe::ffff + +Network Groups +============== + +**Network groups** accept IP networks in CIDR notation. You can add specific +IP addresses as a 32-bit prefix. If you need to add a mix of addresses and +networks, use a network group. + +.. cfgcmd:: set firewall group network-group network +.. cfgcmd:: set firewall group ipv6-network-group network + + Define an IPv4 or IPv6 network group. + + .. code-block:: none + + set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24 + set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24 + set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64 + +.. cfgcmd:: set firewall group network-group description +.. cfgcmd:: set firewall group ipv6-network-group description + + Provide an IPv4 or IPv6 network group description. + +Interface Groups +================ + +An **interface group** represents a collection of interfaces. + +.. cfgcmd:: set firewall group interface-group interface + + Define an interface group. + Wildcard ``*`` is supported. For example: ``eth3*``. + Prepend the character ``!`` to invert the criteria. For example: ``!eth2``. + +.. code-block:: none + + set firewall group interface-group LAN interface bond1001 + set firewall group interface-group LAN interface eth3* + +.. cfgcmd:: set firewall group interface-group description + + Provide an interface group description. + +Port Groups +=========== + +A **port group** represents only port numbers, not the protocol. You can +reference port groups for either TCP or UDP. Create TCP and UDP groups +separately to avoid accidentally filtering unnecessary ports. Specify port +ranges by using `-`. + +.. cfgcmd:: set firewall group port-group port + [portname | portnumber | startport-endport] + + Define a port group. A port name can be any name defined in + /etc/services. For example, ``http``. + + .. code-block:: none + + set firewall group port-group PORT-TCP-SERVER1 port http + set firewall group port-group PORT-TCP-SERVER1 port 443 + set firewall group port-group PORT-TCP-SERVER1 port 5000-5010 + +.. cfgcmd:: set firewall group port-group description + + Provide a port group description. + +MAC Groups +========== + +A **mac group** represents a collection of mac addresses. + +.. cfgcmd:: set firewall group mac-group mac-address + + Define a mac group. + +.. code-block:: none + + set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f + set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81 + +.. cfgcmd:: set firewall group mac-group description + + Provide a MAC group description. + +Domain Groups +============= + +A **domain group** represents a collection of domains. + +.. cfgcmd:: set firewall group domain-group address + + Define a domain group. + +.. code-block:: none + + set firewall group domain-group DOM address example.com + +.. cfgcmd:: set firewall group domain-group description + + Provide a domain group description. + +Dynamic Groups +============== + +Firewall dynamic groups differ from other groups because you can use them as +source/destination in firewall rules, and members are not defined statically +in VyOS configuration. Instead, firewall rules dynamically add members to +these groups. + +Defining Dynamic Address Groups +------------------------------- + +Dynamic address groups support both IPv4 and IPv6 families. Use these +commands to define dynamic IPv4 and IPv6 address groups: + +.. cfgcmd:: set firewall group dynamic-group address-group +.. cfgcmd:: set firewall group dynamic-group ipv6-address-group + +Add description to firewall groups: + +.. cfgcmd:: set firewall group dynamic-group address-group + description +.. cfgcmd:: set firewall group dynamic-group ipv6-address-group + description + +Adding elements to Dynamic Firewall Groups +------------------------------------------ + +After you define dynamic firewall groups, use them in firewall rules to +dynamically add elements to them. + +Commands used for this task are: + +* Add destination IP address of the connection to a dynamic address group: + +.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule + <1-999999> add-address-to-group destination-address address-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group + destination-address address-group +.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule + <1-999999> add-address-to-group destination-address address-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group + destination-address address-group + +* Add source IP address of the connection to a dynamic address group: + +.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule + <1-999999> add-address-to-group source-address address-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group + source-address address-group +.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule + <1-999999> add-address-to-group source-address address-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group + source-address address-group + +You can define specific timeouts per rule. When a rule matches, the source or +destination address is added to the group, and the element remains in the group +until the timeout expires. If you do not define a timeout, the element remains +in the group until the next reboot or until you commit firewall configuration +changes. + +.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule + <1-999999> add-address-to-group [destination-address | source-address] + timeout +.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group + [destination-address | source-address] timeout +.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule + <1-999999> add-address-to-group [destination-address | source-address] + timeout +.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group + [destination-address | source-address] timeout + +Timeout can be defined using seconds, minutes, hours or days: + +.. code-block:: none + + set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout + Possible completions: + s Timeout value in seconds + m Timeout value in minutes + h Timeout value in hours + d Timeout value in days + +Using Dynamic Firewall Groups +----------------------------- + +Like other firewall groups, you can use dynamic firewall groups in firewall +rules as matching options. For example: + +.. code-block:: none + + set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO + set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR + +******** +Examples +******** + +General example +=============== + +After you create firewall groups, you can reference them in firewall, NAT, +NAT66, and/or policy-route rules. The following example creates multiple +groups: + + .. code-block:: none + + set firewall group address-group SERVERS address 198.51.100.101 + set firewall group address-group SERVERS address 198.51.100.102 + set firewall group network-group TRUSTEDv4 network 192.0.2.0/30 + set firewall group network-group TRUSTEDv4 network 203.0.113.128/25 + set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64 + set firewall group interface-group LAN interface eth2.2001 + set firewall group interface-group LAN interface bon0 + set firewall group port-group PORT-SERVERS port http + set firewall group port-group PORT-SERVERS port 443 + set firewall group port-group PORT-SERVERS port 5000-5010 + +And next, some configuration example where groups are used: + + .. code-block:: none + + set firewall ipv4 output filter rule 10 action accept + set firewall ipv4 output filter rule 10 outbound-interface group !LAN + set firewall ipv4 forward filter rule 20 action accept + set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4 + set firewall ipv6 input filter rule 10 action accept + set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6 + set nat destination rule 101 inbound-interface group LAN + set nat destination rule 101 destination group address-group SERVERS + set nat destination rule 101 protocol tcp + set nat destination rule 101 destination group port-group PORT-SERVERS + set nat destination rule 101 translation address 203.0.113.250 + set policy route PBR rule 201 destination group port-group PORT-SERVERS + set policy route PBR rule 201 protocol tcp + set policy route PBR rule 201 set table 15 + +Port knocking example +===================== + +You can use dynamic firewall groups with port knocking to secure access to +the router or any other device. The following example shows a 4-step port +knocking configuration: + + .. code-block:: none + + set firewall global-options state-policy established action 'accept' + set firewall global-options state-policy invalid action 'drop' + set firewall global-options state-policy related action 'accept' + set firewall group dynamic-group address-group ALLOWED + set firewall group dynamic-group address-group PN_01 + set firewall group dynamic-group address-group PN_02 + set firewall ipv4 input filter default-action 'drop' + set firewall ipv4 input filter rule 5 action 'accept' + set firewall ipv4 input filter rule 5 protocol 'icmp' + set firewall ipv4 input filter rule 10 action 'drop' + set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01' + set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m' + set firewall ipv4 input filter rule 10 description 'Port_nock 01' + set firewall ipv4 input filter rule 10 destination port '9990' + set firewall ipv4 input filter rule 10 protocol 'tcp' + set firewall ipv4 input filter rule 20 action 'drop' + set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02' + set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m' + set firewall ipv4 input filter rule 20 description 'Port_nock 02' + set firewall ipv4 input filter rule 20 destination port '9991' + set firewall ipv4 input filter rule 20 protocol 'tcp' + set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01' + set firewall ipv4 input filter rule 30 action 'drop' + set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED' + set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h' + set firewall ipv4 input filter rule 30 description 'Port_nock 03' + set firewall ipv4 input filter rule 30 destination port '9992' + set firewall ipv4 input filter rule 30 protocol 'tcp' + set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02' + set firewall ipv4 input filter rule 99 action 'accept' + set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh' + set firewall ipv4 input filter rule 99 destination port '22' + set firewall ipv4 input filter rule 99 protocol 'tcp' + set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED' + +Before testing, we can check the members of firewall groups: + + .. code-block:: none + + vyos@vyos# run show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------- ---------------------- -------------------- ------------- --------- --------- + ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D + PN_01 address_group(dynamic) ipv4-input-filter-10 N/D N/D N/D + PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D + [edit] + vyos@vyos# + +With this configuration, to gain SSH access to the router, the user must: + +1. Create a new TCP connection to destination port 9990. A new entry is added + to dynamic firewall group ``PN_01``. + + .. code-block:: none + + vyos@vyos# run show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------- ---------------------- -------------------- ------------- --------- --------- + ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D + PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 119 + PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D + [edit] + vyos@vyos# + +2. Create a new TCP connection to destination port 9991. A new entry is added + to dynamic firewall group ``PN_02``. + + .. code-block:: none + + vyos@vyos# run show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------- ---------------------- -------------------- ------------- --------- --------- + ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D + PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 106 + PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 179 + [edit] + vyos@vyos# + +3. Create a new TCP connection to destination port 9992. A new entry is added + to dynamic firewall group ``ALLOWED``. + + .. code-block:: none + + vyos@vyos# run show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------- ---------------------- -------------------- ------------- --------- --------- + ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.89.31 7200 7199 + PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 89 + PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 170 + [edit] + vyos@vyos# + +4. Now you can connect via SSH to the router (assuming SSH is + configured). + +************** +Operation-mode +************** + +.. opcmd:: show firewall group +.. opcmd:: show firewall group + + Display an overview of defined groups, including the firewall group name, + type, references (where the group is used), members, timeout, and + expiration (the last two only apply to dynamic firewall groups). + +Here is an example of such command: + + .. code-block:: none + + vyos@vyos:~$ show firewall group + Firewall Groups + + Name Type References Members Timeout Expires + ------------ ---------------------- ---------------------- ---------------- --------- --------- + SERVERS address_group nat-destination-101 198.51.100.101 + 198.51.100.102 + ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.77.39 7200 7174 + PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.0.245 120 112 + 192.168.77.39 120 85 + PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.77.39 180 151 + LAN interface_group ipv4-output-filter-10 bon0 + nat-destination-101 eth2.2001 + TRUSTEDv6 ipv6_network_group ipv6-input-filter-10 2001:db8::/64 + TRUSTEDv4 network_group ipv4-forward-filter-20 192.0.2.0/30 + 203.0.113.128/25 + PORT-SERVERS port_group route-PBR-201 443 + route-PBR-201 5000-5010 + nat-destination-101 http + vyos@vyos:~$ diff --git a/docs/configuration/firewall/rst-index.rst b/docs/configuration/firewall/rst-index.rst new file mode 100644 index 00000000..c4b3c808 --- /dev/null +++ b/docs/configuration/firewall/rst-index.rst @@ -0,0 +1,267 @@ +:lastproofread: 2026-03-30 + +######## +Firewall +######## + +.. warning:: Due to a boot-time race condition, all interfaces initialize + before the firewall. This temporarily leaves the system open to all traffic + and poses a security risk. + +VyOS uses Netfilter. The Netfilter +project developed ``iptables`` and its successor ``nftables`` for the Linux +kernel to process packet data flows directly. This extends the concept of +zone-based security to let you manipulate data at multiple stages after the +network interface and driver accept it, and before sending it to its +destination (for example, a web server or another device). + +The following is a simplified traffic flow diagram based on Netfilter +packet flow. +This diagram provides an overview of how packets are processed and the +possible paths traffic can take. + +.. figure:: /_static/images/firewall-gral-packet-flow.* + +The main points regarding packet flow and terminology in VyOS firewall +are: + + * **Bridge Port?**: Choose the appropriate path based on whether the + interface where the packet was received is part of a bridge. + +If the interface where the packet was received is not part of a bridge, the +packet is processed at the **IP Layer**: + + * **Prerouting**: The router processes all packets in this stage, + regardless of the destination. You can perform several actions in + this stage, and these actions are also defined in different parts of the + VyOS configuration. Order is important. The relevant configuration that + applies in this stage includes: + + * **Firewall prerouting**: Rules you define under ``set firewall + [ipv4 | ipv6] prerouting raw...``. The system processes all rules in + this section before the connection tracking subsystem. + + * **Conntrack Ignore**: Rules you define under ``set system conntrack + ignore [ipv4 | ipv6] ...``. You can configure this section with + ``firewall [ipv4 | ipv6] prerouting ...``. For compatibility reasons, + this feature is supported, but will be deprecated in the future. + + * **Policy Route**: Rules you define under ``set policy [route | + route6] ...``. + + * **Destination NAT**: Rules you define under ``set [nat | nat66] + destination...``. + + * **Destination is the router?**: Choose the appropriate path based on the + destination IP address. Transit traffic continues to **forward**, while + traffic destined for the router continues to **input**. + + * **Input**: The stage where you filter and control traffic destined for + the router itself. This is where you enforce all rules for securing the + router. This includes IPv4 and IPv6 filtering rules, defined in: + + * ``set firewall ipv4 input filter ...``. + + * ``set firewall ipv6 input filter ...``. + + * **Forward**: The stage where you filter and control transit traffic. + This includes IPv4 and IPv6 filtering rules, defined in: + + * ``set firewall ipv4 forward filter ...``. + + * ``set firewall ipv6 forward filter ...``. + + * **Output**: The stage where you filter and control traffic that the + router originates. Note that this traffic comes from either a new + connection that an internal process on the VyOS router (such as NTP) + originates or a response to traffic the router receives externally through + **input** (for example, a response to an SSH login attempt). This includes + IPv4 and IPv6 rules, and two different sections apply: + + * **Output Prerouting**: ``set firewall [ipv4 | ipv6] output + filter ...``. As described in **Prerouting**, the system processes + rules in this section before the connection tracking subsystem. + + * **Output Filter**: ``set firewall [ipv4 | ipv6] output filter ...``. + + * **Postrouting**: As in **Prerouting**, you can perform several actions + defined in different parts of VyOS configuration in this stage. This + includes: + + * **Source NAT**: Rules you define under ``set [nat | nat66] + destination...``. + +If the interface where the packet was received is part of a bridge, the +packet is processed at the **Bridge Layer**: + + * **Prerouting (Bridge)**: The bridge processes all packets it receives in + this stage, regardless of the destination. First, you can apply filters + here, or you can configure rules that ignore the connection tracking + system. The relevant configuration that applies: + + * ``set firewall bridge prerouting filter ...``. + + * **Forward (Bridge)**: The stage where you filter and control traffic + that passes through the bridge: + + * ``set firewall bridge forward filter ...``. + + * **Input (Bridge)**: The stage where you filter and control traffic + destined for the bridge itself: + + * ``set firewall bridge input filter ...``. + + * **Output (Bridge)**: The stage where you filter and control traffic that + the bridge originates: + + * ``set firewall bridge output filter ...``. + +The following is the overall structure of the VyOS firewall CLI: + +.. code-block:: none + + - set firewall + * bridge + - forward + + filter + - input + + filter + - output + + filter + - prerouting + + filter + - name + + custom_name + * flowtable + - custom_flow_table + + ... + * global-options + + all-ping + + broadcast-ping + + ... + * group + - address-group + - ipv6-address-group + - network-group + - ipv6-network-group + - interface-group + - mac-group + - port-group + - domain-group + * ipv4 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - name + + custom_name + * ipv6 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - ipv6-name + + custom_name + * zone + - custom_zone_name + + ... + +Here is a list of VyOS firewall CLI subcommands and their +corresponding pages in the documentation: + +.. cfgcmd:: set firewall bridge ... + + Configure bridge firewall rules for traffic at the bridge layer. For detailed + information, see + :doc:`Bridge Firewall Configuration`. + +.. cfgcmd:: set firewall flowtable ... + + Configure firewall flowtables for stateful connection tracking and rules. + For detailed information, see + :doc:`Flowtables Firewall Configuration ` + . + +.. cfgcmd:: set firewall global-options ... + + Configure global firewall options such as ``all-ping``, ``broadcast-ping``, + ``syn-cookies``, and other system-wide firewall settings. For detailed + information, see + :doc:`Global Firewall Options`. + +.. cfgcmd:: set firewall group ... + + Organize firewall rules by creating reusable address, network, interface, + MAC, port, and domain groups. Use groups in multiple rules to simplify + configuration and maintenance. For detailed information, see + :doc:`Firewall Groups`. + +.. cfgcmd:: set firewall ipv4 ... + + Configure IPv4-specific firewall rules. For detailed information, see + :doc:`IPv4 Firewall Configuration`. + +.. cfgcmd:: set firewall ipv6 ... + + Configure IPv6-specific firewall rules. For detailed information, see + :doc:`IPv6 Firewall Configuration`. + +.. cfgcmd:: set firewall zone ... + + Configure zone-based firewall policies for controlling traffic between + different network zones. For detailed information, see + :doc:`Zone-Based Firewall Configuration`. + +For more information on firewall configuration, see the following pages: + +.. toctree:: + :maxdepth: 1 + :includehidden: + + global-options + groups + bridge + ipv4 + ipv6 + flowtables + +.. note:: + For more information on Netfilter hooks and Linux networking packet flows, + see the `Netfilter-Hooks + `_ + documentation. + + +Zone-Based firewall +^^^^^^^^^^^^^^^^^^^ + +.. toctree:: + :maxdepth: 1 + :includehidden: + + zone + +With zone-based firewalls, a new concept applies. In addition to the standard +in and out traffic flows, a local flow enables traffic originating from and +destined to the router itself. This means you must configure additional rules to +secure the firewall from the network, in addition to the existing inbound and +outbound rules. + +To configure VyOS with zone-based firewall, see +:doc:`Zone-Based Firewall Configuration `. + +As the following example image shows, you must configure rules to allow or block +traffic to or from the services running on the device that have open +connections on that interface. + +.. figure:: /_static/images/firewall-zonebased.* diff --git a/docs/configuration/firewall/rst-ipv4.rst b/docs/configuration/firewall/rst-ipv4.rst new file mode 100644 index 00000000..efd0fe18 --- /dev/null +++ b/docs/configuration/firewall/rst-ipv4.rst @@ -0,0 +1,1305 @@ +:lastproofread: 2026-03-30 + +.. _firewall-ipv4-configuration: + +########################### +IPv4 Firewall Configuration +########################### + +******** +Overview +******** + +This section provides information on IPv4 firewall configuration and +appropriate operation-mode commands. This section covers the following +configuration commands: + +.. cfgcmd:: set firewall ipv4 ... + +To learn about the general traffic flow in VyOS firewalls, +see :doc:`Firewall `. + +.. code-block:: none + + - set firewall + * ipv4 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - name + + custom_name + +First, the router receives all traffic and processes it in the **prerouting** +stage. + +This stage includes: + + * **Firewall Prerouting**: commands found under ``set firewall ipv4 + prerouting raw ...`` + * :doc:`Conntrack Ignore`: ``set system + conntrack ignore ipv4...`` + * :doc:`Policy Route`: commands found under + ``set policy route ...`` + * :doc:`Destination NAT`: commands found under + ``set nat destination ...`` + +For transit traffic, which is received by the router and forwarded, the base +chain is **forward**. The following is a simplified packet flow diagram for +transit traffic: + +.. figure:: /_static/images/firewall-fwd-packet-flow.* + +The base firewall chain for configuring filtering rules for transit traffic is +``set firewall ipv4 forward filter ...``, which occurs in stage 5, highlighted +in red. + +For traffic to the router itself, the base chain is **input**. For traffic +the router originates, the base chain is **output**. A simplified packet flow +diagram is shown next, which shows the path for traffic destined to the router +itself and traffic the router generates (starting from circle number 6): + +.. figure:: /_static/images/firewall-input-packet-flow.* + +The base chain for traffic towards the router is +``set firewall ipv4 input filter ...`` + +The base chain for traffic the router generates is ``set firewall ipv4 +output ...``, where two sub-chains are available: **filter** and **raw**: + +* **Output Prerouting**: ``set firewall ipv4 output raw ...``. As described + in **Prerouting**, the system processes rules in this section before the + connection tracking subsystem. +* **Output Filter**: ``set firewall ipv4 output filter ...``. The system + processes rules in this section after the connection tracking subsystem. + +.. note:: **Important note about default-actions:** + If you do not define a default action for a base chain, the system sets + the default action to **accept** for that chain. For custom chains, if you + do not define a default action, the system sets the default-action to + **drop**. + +You can create custom firewall chains using the following commands: +``set firewall ipv4 name ...``. To use a custom chain, you must define +a rule with the **action jump** and the appropriate **target** in a base +chain. + +********************* +Firewall - IPv4 Rules +********************* + +Each firewall rule has a +number, an action to apply if the rule matches, and the ability to specify +multiple matching criteria. Packets traverse rules numbered 1-999999, so order +is crucial. The system executes the rule action at the first match. + +Actions +======= + +If you define a rule, you must define an action for it. The action tells the +firewall what to do if all the criteria you define for that rule are met. + +The action can be: + + * ``accept``: Accept the packet. + + * ``continue``: Continue parsing the next rule. + + * ``drop``: Drop the packet. + + * ``reject``: Reject the packet. + + * ``jump``: Jump to another custom chain. + + * ``return``: Return from the current chain and continue at the next rule + of the last chain. + + * ``queue``: Enqueue packet to userspace. + + * ``synproxy``: Synproxy the packet. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return | synproxy] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return | synproxy] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return] + + This required setting defines the action of the current rule. If you set + the action to jump, you must also specify a jump-target. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + jump-target + + Use this command only when the action is set to ``jump``. Specify the + jump target. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + queue <0-65535> + + Use this command only when the action is set to ``queue``. Specify the + queue target to use. Queue range is also supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + queue-options bypass + + Use this command only when the action is set to ``queue``. Allow the packet + to pass through the firewall when no userspace software is connected to the + queue. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + queue-options fanout + + Use this command only when the action is set to ``queue``. Distribute + packets between several queues. + +Also, **default-action** is an action that applies when a packet does not +match any rule in its chain. For base chains, possible options for +**default-action** are **accept** or **drop**. + +.. cfgcmd:: set firewall ipv4 forward filter default-action + [accept | drop] +.. cfgcmd:: set firewall ipv4 input filter default-action + [accept | drop] +.. cfgcmd:: set firewall ipv4 output filter default-action + [accept | drop] +.. cfgcmd:: set firewall ipv4 name default-action + [accept | drop | jump | queue | reject | return] + + This command sets the default action of the rule-set if a packet does not + match the criteria of any rule. If you set the default-action to ``jump``, + you must also specify ``default-jump-target``. Note that for base chains, + you can set the default action only to ``accept`` or ``drop``, while on + custom chains, more actions are available. + +.. cfgcmd:: set firewall ipv4 name default-jump-target + + Use this command only when you set ``default-action`` to ``jump``. Specify + the jump target for the default rule. + +.. note:: **Important note about default-actions:** + If you do not define a default action for a base chain, the system sets + the default action to **accept** for that chain. For custom chains, if you + do not define a default action, the system sets the default-action to + **drop**. + +Firewall Logs +============= + +You can enable logging for every single firewall rule. If you enable logging, +you can define other log options. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> log +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> log +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> log +.. cfgcmd:: set firewall ipv4 name rule <1-999999> log + + Enable logging for the matched packet. If this command is not present, then + logging is not enabled. + +.. cfgcmd:: set firewall ipv4 forward filter default-log +.. cfgcmd:: set firewall ipv4 input filter default-log +.. cfgcmd:: set firewall ipv4 output filter default-log +.. cfgcmd:: set firewall ipv4 name default-log + + Use this command to enable logging of the default action on the specified + chain. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] + + Define the log level. Only applicable if you enable rule logging. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + log-options group <0-65535> + + Define the log group to send messages to. Only applicable if you enable rule + logging. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + log-options snapshot-length <0-9000> + + Define the length of packet payload to include in a netlink message. Only + applicable if you enable rule logging and define the log group. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + log-options queue-threshold <0-65535> + + Define the number of packets to queue inside the kernel before sending them + to userspace. Only applicable if you enable rule logging and define the log + group. + +Firewall Description +==================== + +You can add a description for reference for every single rule and for every +defined custom chain. + +.. cfgcmd:: set firewall ipv4 name description + + Provide a rule-set description for a custom firewall chain. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + description +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + description +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + description +.. cfgcmd:: set firewall ipv4 name rule <1-999999> description + + Provide a description for each rule. + +Rule Status +=========== + +When you define a rule, it is enabled by default. In some cases, it is useful +to disable the rule rather than removing it. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> disable +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> disable +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> disable +.. cfgcmd:: set firewall ipv4 name rule <1-999999> disable + + Command for disabling a rule but keeping it in the configuration. + +Matching criteria +================= + +There are a lot of matching criteria against which the packet can be tested. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + connection-status nat [destination | source] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + connection-status nat [destination | source] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + connection-status nat [destination | source] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + connection-status nat [destination | source] + + Match based on nat connection status. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + connection-mark <1-2147483647> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + connection-mark <1-2147483647> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + connection-mark <1-2147483647> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + connection-mark <1-2147483647> + + Match based on connection mark. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + conntrack-helper +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + conntrack-helper +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + conntrack-helper +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + conntrack-helper + + Match based on connection tracking protocol helper module to secure use of + that helper module. See below for possible completions ``. + + .. code-block:: none + + Possible completions: + ftp Related traffic from FTP helper + h323 Related traffic from H.323 helper + pptp Related traffic from PPTP helper + nfs Related traffic from NFS helper + sip Related traffic from SIP helper + tftp Related traffic from TFTP helper + sqlnet Related traffic from SQLNet helper + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source address [address | addressrange | CIDR] + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination address [address | addressrange | CIDR] + + Match criteria based on source and/or destination address. This is similar + to the network groups part, but here you are able to negate the matching + addresses. + + .. code-block:: none + + set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11 + # with a '!' the rule match everything except the specified subnet + set firewall ipv4 input filter FOO rule 51 source address !203.0.113.0/24 + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source address-mask [address] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source address-mask [address] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source address-mask [address] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source address-mask [address] + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination address-mask [address] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination address-mask [address] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination address-mask [address] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination address-mask [address] + + An arbitrary netmask can be applied to mask addresses to only match against + a specific portion. + + This functions for both individual addresses and address groups. + + .. code-block:: none + + # Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet + set firewall ipv4 name FOO rule 100 destination address 0.11.0.13 + set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255 + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination fqdn +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination fqdn +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination fqdn +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination fqdn + + Specify a Fully Qualified Domain Name as source/destination to match. Ensure + that the router is able to resolve this dns query. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source geoip country-code +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source geoip country-code +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source geoip country-code +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source geoip country-code + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination geoip country-code +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination geoip country-code +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination geoip country-code +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination geoip country-code + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source geoip inverse-match +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source geoip inverse-match +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source geoip inverse-match +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source geoip inverse-match + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination geoip inverse-match +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination geoip inverse-match +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination geoip inverse-match +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination geoip inverse-match + + Match IP addresses based on its geolocation. More info: `geoip matching + `_. + Use inverse-match to match anything except the given country-codes. + +Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, +permits redistribution so we can include a database in images(~3MB +compressed). Includes cron script (manually callable by op-mode update +geoip) to keep database and rules updated. + + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source mac-address +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source mac-address +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source mac-address +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source mac-address + + You can only specify a source mac-address to match. + + .. code-block:: none + + set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33 + set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34 + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source port [1-65535 | portname | start-end] + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination port [1-65535 | portname | start-end] + + A port can be set by number or name as defined in ``/etc/services``. + + .. code-block:: none + + set firewall ipv4 forward filter rule 10 source port '22' + set firewall ipv4 forward filter rule 11 source port '!http' + set firewall ipv4 forward filter rule 12 source port 'https' + + Multiple source ports can be specified as a comma-separated list. + The whole list can also be "negated" using ``!``. For example: + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source group address-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source group address-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source group address-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source group address-group + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination group address-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination group address-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination group address-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination group address-group + + Use a specific address-group. Prepending the character ``!`` to invert the + criteria to match is also supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source group dynamic-address-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source group dynamic-address-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source group dynamic-address-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source group dynamic-address-group + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination group dynamic-address-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination group dynamic-address-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination group dynamic-address-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination group dynamic-address-group + + Use a specific dynamic-address-group. Prepending the character ``!`` to + invert the criteria to match is also supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source group network-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source group network-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source group network-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source group network-group + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination group network-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination group network-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination group network-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination group network-group + + Use a specific network-group. Prepending the character ``!`` to invert the + criteria to match is also supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source group port-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source group port-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source group port-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source group port-group + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination group port-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination group port-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination group port-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination group port-group + + Use a specific port-group. Prepending the character ``!`` to invert the + criteria to match is also supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source group domain-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source group domain-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source group domain-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source group domain-group + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination group domain-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination group domain-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination group domain-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination group domain-group + + Use a specific domain-group. Prepending the character ``!`` to invert the + criteria to match is also supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + source group mac-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + source group mac-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + source group mac-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + source group mac-group + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + destination group mac-group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + destination group mac-group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + destination group mac-group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + destination group mac-group + + Use a specific mac-group. Prepending the character ``!`` to invert the + criteria to match is also supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + dscp [0-63 | start-end] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + dscp [0-63 | start-end] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + dscp [0-63 | start-end] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + dscp [0-63 | start-end] + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + dscp-exclude [0-63 | start-end] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + dscp-exclude [0-63 | start-end] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + dscp-exclude [0-63 | start-end] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + dscp-exclude [0-63 | start-end] + + Match based on dscp value. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + fragment [match-frag | match-non-frag] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + fragment [match-frag | match-non-frag] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + fragment [match-frag | match-non-frag] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + fragment [match-frag | match-non-frag] + + Match based on fragmentation. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + icmp [code | type] <0-255> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + icmp [code | type] <0-255> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + icmp [code | type] <0-255> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + icmp [code | type] <0-255> + + Match based on icmp code and type. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + icmp type-name +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + icmp type-name +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + icmp type-name +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + icmp type-name + + Match based on icmp type-name. Use tab for information + about what **type-name** criteria are supported. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + inbound-interface name +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + inbound-interface name +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + inbound-interface name + + Match based on inbound interface. Wildcard ``*`` is supported. For example: + ``eth2*``. Prepend the character ``!`` to invert the criteria. For example: + ``!eth2`` + +.. note:: If an interface is attached to a non-default vrf, when using + **inbound-interface**, the vrf name must be used. For example ``set firewall + ipv4 forward filter rule 10 inbound-interface name MGMT`` + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + inbound-interface group +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + inbound-interface group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + inbound-interface group + + Match based on the inbound interface group. Prepend the character ``!`` to + invert the criteria. For example, ``!IFACE_GROUP`` + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + outbound-interface name +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + outbound-interface name +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + outbound-interface name + + Match based on outbound interface. Wildcard ``*`` is supported. For example: + ``eth2*``. Prepend the character ``!`` to invert the criteria. For example: + ``!eth2`` + +.. note:: If an interface is attached to a non-default vrf, when using + **outbound-interface**, the real interface name must be used. For example + ``set firewall ipv4 forward filter rule 10 outbound-interface name eth0`` + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + outbound-interface group +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + outbound-interface group +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + outbound-interface group + + Match based on outbound interface group. Prepend the character ``!`` to + invert the criteria. For example: ``!IFACE_GROUP`` + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + ipsec [match-ipsec-in | match-none-in] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + ipsec [match-ipsec-out | match-none-out] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] + + Match based on ipsec. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + limit burst <0-4294967295> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + limit burst <0-4294967295> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + limit burst <0-4294967295> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + limit burst <0-4294967295> + + Match based on the maximum number of packets to allow in excess of rate. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + limit rate +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + limit rate +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + limit rate +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + limit rate + + Specify the maximum average rate as **integer/unit**. For example: + **5/minutes** + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + packet-length +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + packet-length +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + packet-length +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + packet-length + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + packet-length-exclude +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + packet-length-exclude +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + packet-length-exclude +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + packet-length-exclude + + Match based on packet length. Specify multiple values from 1 to 65535 and + ranges. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + packet-type [broadcast | host | multicast | other] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + packet-type [broadcast | host | multicast | other] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + packet-type [broadcast | host | multicast | other] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + packet-type [broadcast | host | multicast | other] + + Match based on the packet type. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] + + Match based on protocol number or name as defined in ``/etc/protocols``. + Special names are ``all`` for all protocols and ``tcp_udp`` for TCP and UDP + based packets. The ``!`` character negates the selected protocol. + + .. code-block:: none + + set firewall ipv4 forward filter rule 10 protocol tcp_udp + set firewall ipv4 forward filter rule 11 protocol !tcp_udp + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + recent count <1-255> + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + recent time [second | minute | hour] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + recent time [second | minute | hour] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + recent time [second | minute | hour] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + recent time [second | minute | hour] + + Match based on recently seen sources. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + tcp flags [not] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + tcp flags [not] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + tcp flags [not] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + tcp flags [not] + + Specify TCP flags. Allowed values are ``ack``, ``cwr``, ``ecn``, ``fin``, + ``psh``, ``rst``, ``syn``, and ``urg``. Specify multiple values, and use + ``not`` for inverted selection, as shown in the example. + + .. code-block:: none + + set firewall ipv4 input filter rule 10 tcp flags 'ack' + set firewall ipv4 input filter rule 12 tcp flags 'syn' + set firewall ipv4 input filter rule 13 tcp flags not 'fin' + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + state [established | invalid | new | related] +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + state [established | invalid | new | related] +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + state [established | invalid | new | related] +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + state [established | invalid | new | related] + + Match against the state of a packet. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + time weekdays +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + time weekdays +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + time weekdays +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + time weekdays + + Time to match the defined rule. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + ttl <0-255> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + ttl <0-255> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + ttl <0-255> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + ttl <0-255> + + Match the time to live parameter, where 'eq' means 'equal', 'gt' means + 'greater than', and 'lt' means 'less than'. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + recent count <1-255> + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + recent time +.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> + recent time +.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> + recent time +.. cfgcmd:: set firewall ipv4 name rule <1-999999> + recent time + + Match when 'count' amount of connections appear within 'time'. Use these + matching criteria to block brute-force attempts. + +Packet Modifications +==================== + +Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify +packets before sending them out. This feature provides more flexibility in +packet handling. + +.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> + set dscp <0-63> +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + set dscp <0-63> +.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> + set dscp <0-63> + + Set a specific value of Differentiated Services Codepoint (DSCP). + +.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> + set mark <1-2147483647> +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + set mark <1-2147483647> +.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> + set mark <1-2147483647> + + Set a specific packet mark value. + +.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> + set tcp-mss <500-1460> +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + set tcp-mss <500-1460> +.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> + set tcp-mss <500-1460> + + Set the TCP-MSS (TCP maximum segment size) for the connection. + +.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> + set ttl <0-255> +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + set ttl <0-255> +.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> + set ttl <0-255> + + Set the TTL (Time to Live) value. + +.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> + set connection-mark <0-2147483647> +.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> + set connection-mark <0-2147483647> + + Set connection mark value. + +******** +Synproxy +******** +Synproxy connections + +.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> + action synproxy +.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> + protocol tcp +.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> + synproxy tcp mss <501-65535> + + Set the TCP-MSS (maximum segment size) for the connection + +.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> + synproxy tcp window-scale <1-14> + + Set the window scale factor for TCP window scaling + +Example synproxy +================ +Requirements to enable synproxy: + + * Traffic must be symmetric. + * Synproxy relies on syncookies and TCP timestamps, ensure these are enabled. + * Disable conntrack loose track option. + +.. code-block:: none + + set system sysctl parameter net.ipv4.tcp_timestamps value '1' + + set system conntrack tcp loose disable + set system conntrack ignore ipv4 rule 10 destination port '8080' + set system conntrack ignore ipv4 rule 10 protocol 'tcp' + set system conntrack ignore ipv4 rule 10 tcp flags syn + + set firewall global-options syn-cookies 'enable' + set firewall ipv4 input filter rule 10 action 'synproxy' + set firewall ipv4 input filter rule 10 destination port '8080' + set firewall ipv4 input filter rule 10 inbound-interface name 'eth1' + set firewall ipv4 input filter rule 10 protocol 'tcp' + set firewall ipv4 input filter rule 10 synproxy tcp mss '1460' + set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7' + set firewall ipv4 input filter rule 1000 action 'drop' + set firewall ipv4 input filter rule 1000 state invalid + +*********************** +Operation-mode Firewall +*********************** + +Rule-set overview +================= + +.. opcmd:: show firewall + + This will show you a basic firewall overview, for all rule-sets, not + only for IPv4. + + .. code-block:: none + + vyos@vyos:~$ show firewall + Rulesets Information + + --------------------------------- + ipv4 Firewall "forward filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ----------------------------- + 20 accept all 0 0 ip saddr @N_TRUSTEDv4 accept + 21 jump all 0 0 jump NAME_AUX + default accept all 0 0 + + --------------------------------- + ipv4 Firewall "input filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ------------------------- + 10 accept all 156 14377 iifname != @I_LAN accept + default accept all 0 0 + + --------------------------------- + ipv4 Firewall "name AUX" + + Rule Action Protocol Packets Bytes Conditions + ------ -------- ---------- --------- ------- -------------------------------------------- + 10 accept icmp 0 0 meta l4proto icmp accept + 20 accept udp 0 0 meta l4proto udp ip saddr @A_SERVERS accept + 30 drop all 0 0 ip saddr != @A_SERVERS iifname "eth2" + + --------------------------------- + ipv4 Firewall "output filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------------------------- + 10 reject all 0 0 oifname @I_LAN + 20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept + default accept all 72 9258 + + --------------------------------- + ipv6 Firewall "input filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ------------------------------- + 10 accept all 0 0 ip6 saddr @N6_TRUSTEDv6 accept + default accept all 2 112 + + vyos@vyos:~$ + +.. opcmd:: show firewall summary + + This shows you a summary of rule-sets and groups. + + .. code-block:: none + + vyos@vyos:~$ show firewall summary + Ruleset Summary + + IPv6 Ruleset: + + Ruleset Hook Ruleset Priority Description + -------------- -------------------- ------------------------- + forward filter + input filter + ipv6_name IPV6-VyOS_MANAGEMENT + ipv6_name IPV6-WAN_IN PUBLIC_INTERNET + + IPv4 Ruleset: + + Ruleset Hook Ruleset Priority Description + -------------- ------------------ ------------------------- + forward filter + input filter + name VyOS_MANAGEMENT + name WAN_IN PUBLIC_INTERNET + + Firewall Groups + + Name Type References Members + ----------------------- ------------------ ----------------------- ---------------- + PBX address_group WAN_IN-100 198.51.100.77 + SERVERS address_group WAN_IN-110 192.0.2.10 + WAN_IN-111 192.0.2.11 + WAN_IN-112 192.0.2.12 + WAN_IN-120 + WAN_IN-121 + WAN_IN-122 + SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 + WAN_IN-20 + PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 + PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2 + WAN_IN-171 + PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 + SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 + IPV6-WAN_IN-111 2001:db8::3 + IPV6-WAN_IN-112 2001:db8::4 + IPV6-WAN_IN-120 + IPV6-WAN_IN-121 + IPV6-WAN_IN-122 + SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 + IPV6-WAN_IN-20 + + +.. opcmd:: show firewall ipv4 [forward | input | output] filter + +.. opcmd:: show firewall ipv4 name + + This command will give an overview of a single rule-set. + + .. code-block:: none + + vyos@vyos:~$ show firewall ipv4 input filter + Ruleset Information + + --------------------------------- + IPv4 Firewall "input filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ----------------------------------------- + 5 jump all 0 0 iifname "eth2" jump NAME_VyOS_MANAGEMENT + default accept all + +.. opcmd:: show firewall ipv4 [forward | input | output] + filter rule <1-999999> +.. opcmd:: show firewall ipv4 name rule <1-999999> + + This command gives an overview of a rule in a single rule-set, plus + information for default action. + +.. code-block:: none + + vyos@vyos:~$show firewall ipv4 output filter rule 20 + Rule Information + + --------------------------------- + ipv4 Firewall "output filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------------------------- + 20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept + default accept all 286 47614 + + vyos@vyos:~$ + + +.. opcmd:: show firewall statistics + + This will show you statistics of all rule-sets since the last boot. + +Show Firewall log +================= + +.. opcmd:: show log firewall +.. opcmd:: show log firewall ipv4 +.. opcmd:: show log firewall ipv4 [forward | input | output | name] +.. opcmd:: show log firewall ipv4 [forward | input | output] filter +.. opcmd:: show log firewall ipv4 name +.. opcmd:: show log firewall ipv4 [forward | input | output] filter rule +.. opcmd:: show log firewall ipv4 name rule + + Show the logs of all firewall; show all IPv4 firewall logs; show all logs + for particular hook; show all logs for particular hook and priority; + show all logs for particular custom chain; show logs for specific rule-set. + +Example Partial Config +====================== + +.. code-block:: none + + firewall { + group { + network-group BAD-NETWORKS { + network 198.51.100.0/24 + network 203.0.113.0/24 + } + network-group GOOD-NETWORKS { + network 192.0.2.0/24 + } + port-group BAD-PORTS { + port 65535 + } + } + ipv4 { + forward { + filter { + default-action accept + rule 5 { + action accept + source { + group { + network-group GOOD-NETWORKS + } + } + } + rule 10 { + action drop + description "Bad Networks" + protocol all + source { + group { + network-group BAD-NETWORKS + } + } + } + } + } + } + } + +Update geoip database +===================== + +.. opcmd:: update geoip + + Command to update GeoIP database and firewall sets. diff --git a/docs/configuration/firewall/rst-ipv6.rst b/docs/configuration/firewall/rst-ipv6.rst new file mode 100644 index 00000000..d31ceb6f --- /dev/null +++ b/docs/configuration/firewall/rst-ipv6.rst @@ -0,0 +1,1302 @@ +:lastproofread: 2026-04-01 + +.. _firewall-ipv6-configuration: + +########################### +IPv6 Firewall Configuration +########################### + +******** +Overview +******** + +This section covers useful information about IPv6 firewall configuration and +appropriate operation-mode commands. + +This section describes the following configuration commands: + +.. cfgcmd:: set firewall ipv6 ... + +To learn about the general traffic flow in VyOS firewalls, +see :doc:`Firewall `. + +.. code-block:: none + + - set firewall + * ipv6 + - forward + + filter + - input + + filter + - output + + filter + + raw + - prerouting + + raw + - name + + custom_name + +The router first receives all traffic and processes it in the **prerouting** +section. + +This stage includes: + + * **Firewall Prerouting**: commands found under ``set firewall ipv6 + prerouting raw ...`` + * :doc:`Conntrack Ignore`: ``set system + conntrack ignore ipv6...`` + * :doc:`Policy Route`: commands found under + ``set policy route6 ...`` + * :doc:`Destination NAT`: commands found under + ``set nat66 destination ...`` + +For transit traffic that the router receives and forwards, the base chain is +**forward**. The following diagram shows a simplified packet flow for transit +traffic: + +.. figure:: /_static/images/firewall-fwd-packet-flow.* + +Use ``set firewall ipv6 forward filter ...`` to configure filtering rules for +transit traffic. This command corresponds to stage 5 and is highlighted in red +in the diagram. + +For traffic destined to the router, use the **input** chain. For traffic the +router generates, use the **output** chain. The following diagram shows the +packet flow for traffic destined to the router and traffic generated by the +router (starting from circle number 6): + +.. figure:: /_static/images/firewall-input-packet-flow.* + +Use ``set firewall ipv6 input filter ...`` to configure traffic destined to +the router. + +Use ``set firewall ipv6 output ...`` to configure traffic the router generates. +Two sub-chains are available: **filter** and **raw**: + +* **Output Prerouting**: ``set firewall ipv6 output raw ...``. + As described in **Prerouting**, the firewall processes rules in this + section before the connection tracking subsystem. +* **Output Filter**: ``set firewall ipv6 output filter ...``. The firewall + processes rules in this section after the connection tracking subsystem. + +.. note:: **Important note about default-actions:** + If you do not define a default action for a base chain, the system sets + the default action to **accept** for that chain. For custom chains, if you + do not define a default action, the system sets the default-action to + **drop** + +Create custom firewall chains using the commands +``set firewall ipv6 name ...``. To use the custom chain, define a +rule with **action jump** and the appropriate **target** in a base chain. + +****************************** +Firewall - IPv6 Rules +****************************** + +Create firewall rules for firewall filtering. Each rule is numbered and has +an action to apply when the rule is matched. You can specify multiple matching +criteria. Packets go through rules from 1 - 999999, so order is crucial. The +firewall executes the action of the first matching rule. + +Actions +======= + +If you define a rule, you must define an action for it. The action tells the +firewall what to do when all criteria for that rule are met. + +The action can be : + + * ``accept``: accept the packet. + + * ``continue``: continue parsing next rule. + + * ``drop``: drop the packet. + + * ``reject``: reject the packet. + + * ``jump``: jump to another custom chain. + + * ``return``: Return from the current chain and continue at the next rule + of the last chain. + + * ``queue``: Enqueue packet to userspace. + + * ``synproxy``: synproxy the packet. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return | synproxy] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return | synproxy] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> action + [accept | continue | drop | jump | queue | reject | return] + + This required setting defines the action of the current rule. If you set + the action to jump, you must also define a jump-target. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + jump-target +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + jump-target + + Use this command only when action is set to ``jump``. Specify the jump + target. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + queue <0-65535> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + queue <0-65535> + + Use this command only when action is set to ``queue``. Specify the queue + target. Queue ranges are also supported. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + queue-options bypass +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + queue-options bypass + + Use this command only when action is set to ``queue``. This command allows + the packet to go through the firewall when no userspace software is connected + to the queue. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + queue-options fanout +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + queue-options fanout + + Use this command only when action is set to ``queue``. This command + distributes packets among multiple queues. + +Also, **default-action** is an action that takes place whenever a packet does +not match any rule in its chain. For base chains, possible options for +**default-action** are **accept** or **drop**. + +.. cfgcmd:: set firewall ipv6 forward filter default-action + [accept | drop] +.. cfgcmd:: set firewall ipv6 input filter default-action + [accept | drop] +.. cfgcmd:: set firewall ipv6 output filter default-action + [accept | drop] +.. cfgcmd:: set firewall ipv6 name default-action + [accept | drop | jump | queue | reject | return] + + Set the default action of the rule-set if a packet does not match any rule + criteria. If you set default-action to ``jump``, you must also define + ``default-jump-target``. For base chains, you can only set the default + action to ``accept`` or ``drop``. For custom chains, more actions are + available. + +.. cfgcmd:: set firewall ipv6 name default-jump-target + + To be used only when ``default-action`` is set to ``jump``. Use this + command to specify the jump target for the default rule. + +.. note:: **Important note about default-actions:** + If you do not define the default action for a base chain, the system sets + the default action to **accept** for that chain. For custom chains, if you + do not define a default action, the system sets the default-action to + **drop**. + +Firewall Logs +============= + +You can enable logging for each firewall rule. When enabled, you can also +define other log options. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> log +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> log +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> log +.. cfgcmd:: set firewall ipv6 name rule <1-999999> log + + Enable logging for matched packets. If this configuration command is not + present, logging is disabled. + +.. cfgcmd:: set firewall ipv6 forward filter default-log +.. cfgcmd:: set firewall ipv6 input filter default-log +.. cfgcmd:: set firewall ipv6 output filter default-log +.. cfgcmd:: set firewall ipv6 name default-log + + Use this command to enable the logging of the default action on + the specified chain. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + log-options level [emerg | alert | crit | err | warn | notice + | info | debug] + + Define log-level. Only applicable if rule log is enabled. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + log-options group <0-65535> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + log-options group <0-65535> + + Define the log group to send messages to. Only applicable if rule log is + enabled. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + log-options snapshot-length <0-9000> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + log-options snapshot-length <0-9000> + + Define the length of packet payload to include in a netlink message. Only + applicable when rule logging is enabled and log group is defined. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + log-options queue-threshold <0-65535> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + log-options queue-threshold <0-65535> + + Define the number of packets to queue inside the kernel before sending them + to userspace. Only applicable when rule logging is enabled and log group is + defined. + +Firewall Description +==================== + +For reference, you can define descriptions on every rule and custom chain. + +.. cfgcmd:: set firewall ipv6 name description + + Provide a rule-set description to a custom firewall chain. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + description +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + description +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + description +.. cfgcmd:: set firewall ipv6 name rule <1-999999> description + + Provide a description for each rule. + +Rule Status +=========== + +New rules are enabled by default. In some cases, you may want to disable a +rule rather than remove it. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> disable +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> disable +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> disable +.. cfgcmd:: set firewall ipv6 name rule <1-999999> disable + + Command for disabling a rule but keep it in the configuration. + +Matching criteria +================= + +There are a lot of matching criteria against which the packet can be tested. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + connection-status nat [destination | source] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + connection-status nat [destination | source] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + connection-status nat [destination | source] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + connection-status nat [destination | source] + + Match packets based on NAT connection status. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + connection-mark <1-2147483647> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + connection-mark <1-2147483647> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + connection-mark <1-2147483647> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + connection-mark <1-2147483647> + + Match packets based on connection mark. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source address [address | addressrange | CIDR] + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination address [address | addressrange | CIDR] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination address [address | addressrange | CIDR] + + Match based on source or destination address. This is similar to network + groups, but you can negate the matching addresses here. + + .. code-block:: none + + set firewall ipv6 name FOO rule 100 source address 2001:db8::202 + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source address-mask [address] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source address-mask [address] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source address-mask [address] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source address-mask [address] + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination address-mask [address] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination address-mask [address] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination address-mask [address] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination address-mask [address] + + Apply an arbitrary netmask to mask addresses and match only a specific + portion. This is useful for IPv6 because rules remain valid when the IPv6 + prefix changes if the host portion of the system's IPv6 address is static. + Examples include SLAAC and `tokenised IPv6 addresses + `_ + + This function works for both individual addresses and address groups. + + .. stop_vyoslinter + .. code-block:: none + + # Match any IPv6 address with the suffix ::0000:0000:0000:beef + set firewall ipv6 forward filter rule 100 destination address ::beef + set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff + # Address groups + set firewall group ipv6-address-group WEBSERVERS address ::1000 + set firewall group ipv6-address-group WEBSERVERS address ::2000 + set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS + set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff + + .. start_vyoslinter + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source fqdn +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination fqdn +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination fqdn +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination fqdn +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination fqdn + + Specify a Fully Qualified Domain Name as source or destination to match. + Ensure that the router can resolve the DNS query. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source geoip country-code +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source geoip country-code +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source geoip country-code +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source geoip country-code + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination geoip country-code +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination geoip country-code +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination geoip country-code +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination geoip country-code + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source geoip inverse-match +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source geoip inverse-match +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source geoip inverse-match +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source geoip inverse-match + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination geoip inverse-match +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination geoip inverse-match +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination geoip inverse-match +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination geoip inverse-match + + Match IP addresses based on their geolocation. For more information, see + `GeoIP matching `_. Use inverse-match to match anything except the specified + country codes. + +DB-IP.com provides data under CC-BY-4.0 license. Attribution is required and +redistribution is permitted, allowing VyOS to include a database in images +(approximately 3 MB compressed). The package includes a cron script that you +can manually call through op-mode update geoip to keep the database and rules +updated. + + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source mac-address +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source mac-address +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source mac-address +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source mac-address + + You can specify only a source MAC address to match. + + .. code-block:: none + + set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33 + set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34 + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source port [1-65535 | portname | start-end] + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination port [1-65535 | portname | start-end] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination port [1-65535 | portname | start-end] + + Specify a port by number or by name as defined in ``/etc/services``. + + .. code-block:: none + + set firewall ipv6 forward filter rule 10 source port '22' + set firewall ipv6 forward filter rule 11 source port '!http' + set firewall ipv6 forward filter rule 12 source port 'https' + + Multiple source ports can be specified as a comma-separated list. + The whole list can also be "negated" using ``!``. For example: + + .. code-block:: none + + set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338' + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source group address-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source group address-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source group address-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source group address-group + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination group address-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination group address-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination group address-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination group address-group + + Specify an address group. You can prepend the character ``!`` to invert the + matching criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source group dynamic-address-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source group dynamic-address-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source group dynamic-address-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source group dynamic-address-group + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination group dynamic-address-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination group dynamic-address-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination group dynamic-address-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination group dynamic-address-group + + Specify a dynamic address group. You can prepend the character ``!`` to + invert the matching criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source group network-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source group network-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source group network-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source group network-group + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination group network-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination group network-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination group network-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination group network-group + + Specify a network group. You can prepend the character ``!`` to invert the + matching criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source group port-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source group port-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source group port-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source group port-group + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination group port-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination group port-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination group port-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination group port-group + + Specify a port group. You can prepend the character ``!`` to invert the + matching criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source group domain-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source group domain-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source group domain-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source group domain-group + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination group domain-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination group domain-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination group domain-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination group domain-group + + Specify a domain group. You can prepend the character ``!`` to invert the + matching criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + source group mac-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + source group mac-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + source group mac-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + source group mac-group + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + destination group mac-group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + destination group mac-group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + destination group mac-group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + destination group mac-group + + Specify a MAC group. You can prepend the character ``!`` to invert the + matching criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + dscp [0-63 | start-end] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + dscp [0-63 | start-end] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + dscp [0-63 | start-end] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + dscp [0-63 | start-end] + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + dscp-exclude [0-63 | start-end] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + dscp-exclude [0-63 | start-end] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + dscp-exclude [0-63 | start-end] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + dscp-exclude [0-63 | start-end] + + Match based on dscp value. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + fragment [match-frag | match-non-frag] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + fragment [match-frag | match-non-frag] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + fragment [match-frag | match-non-frag] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + fragment [match-frag | match-non-frag] + + Match packets based on fragmentation. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + icmpv6 [code | type] <0-255> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + icmpv6 [code | type] <0-255> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + icmpv6 [code | type] <0-255> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + icmpv6 [code | type] <0-255> + + Match packets based on ICMP or ICMPv6 code and type. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + icmpv6 type-name +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + icmpv6 type-name +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + icmpv6 type-name +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + icmpv6 type-name + + Match based on ICMPv6 type-name. Press **Tab** for information about + supported **type-name** criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + inbound-interface name +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + inbound-interface name +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + inbound-interface name + + Match based on inbound interface. You can use the wildcard ``*``. For + example: ``eth2*``. You can prepend the character ``!`` to invert the + matching criteria. For example ``!eth2`` + +.. note:: If an interface is attached to a non-default VRF, when using + **inbound-interface**, use the VRF name. For example: + ``set firewall ipv6 forward filter rule 10 inbound-interface name MGMT`` + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + inbound-interface group +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + inbound-interface group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + inbound-interface group + + Match based on the inbound interface group. You can prepend the character + ``!`` to invert the matching criteria. For example ``!IFACE_GROUP`` + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + outbound-interface name +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + outbound-interface name +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + outbound-interface name + + Match based on outbound interface. You can use the wildcard ``*``. For + example: ``eth2*``. You can prepend the character ``!`` to invert the + matching criteria. For example ``!eth2`` + +.. note:: If an interface is attached to a non-default VRF, when using + **outbound-interface**, use the physical interface name. For example: + ``set firewall ipv6 forward filter rule 10 outbound-interface name eth0`` + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + outbound-interface group +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + outbound-interface group +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + outbound-interface group + + Match based on outbound interface group. You can prepend the character ``!`` + to invert the matching criteria. For example ``!IFACE_GROUP`` + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + ipsec [match-ipsec-in | match-none-in] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + ipsec [match-ipsec-out | match-none-out] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] + + Match packets based on IPsec. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + limit burst <0-4294967295> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + limit burst <0-4294967295> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + limit burst <0-4294967295> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + limit burst <0-4294967295> + + Match based on the maximum number of packets allowed to exceed the rate + limit. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + limit rate +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + limit rate +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + limit rate +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + limit rate + + Match based on the maximum average rate, specified as ``integer/unit``. + For example, specify ``5/minutes``. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + packet-length +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + packet-length +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + packet-length +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + packet-length + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + packet-length-exclude +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + packet-length-exclude +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + packet-length-exclude +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + packet-length-exclude + + Match based on packet length. You can specify multiple values from 1 to + 65535 and ranges. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + packet-type [broadcast | host | multicast | other] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + packet-type [broadcast | host | multicast | other] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + packet-type [broadcast | host | multicast | other] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + packet-type [broadcast | host | multicast | other] + + Match based on packet type. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + protocol [ | <0-255> | all | tcp_udp] + + Match based on protocol number or name as defined in ``/etc/protocols``. + Specify ``all`` for all protocols and ``tcp_udp`` for TCP and UDP packets. + Prepend ``!`` to negate the protocol selection. + + .. code-block:: none + + set firewall ipv6 input filter rule 10 protocol tcp + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + recent count <1-255> + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + recent time [second | minute | hour] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + recent time [second | minute | hour] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + recent time [second | minute | hour] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + recent time [second | minute | hour] + + Match packets based on recently seen sources. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + tcp flags [not] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + tcp flags [not] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + tcp flags [not] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + tcp flags [not] + + Allowed values for TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``, + ``rst``, ``syn``, and ``urg``. You can specify multiple values. To invert + the selection, use ``not``, as shown in the following example. + + .. code-block:: none + + set firewall ipv6 input filter rule 10 tcp flags 'ack' + set firewall ipv6 input filter rule 12 tcp flags 'syn' + set firewall ipv6 input filter rule 13 tcp flags not 'fin' + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + state [established | invalid | new | related] +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + state [established | invalid | new | related] +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + state [established | invalid | new | related] +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + state [established | invalid | new | related] + + Match based on packet state. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + time startdate +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + time starttime +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + time stopdate +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + time stoptime +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + time weekdays +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + time weekdays +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + time weekdays +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + time weekdays + + Match packets based on time criteria. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + hop-limit <0-255> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + hop-limit <0-255> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + hop-limit <0-255> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + hop-limit <0-255> + + Match the hop-limit parameter. Use ``eq`` for equal, ``gt`` for greater than, + and ``lt`` for less than. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + recent count <1-255> +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + recent count <1-255> + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + recent time +.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> + recent time +.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> + recent time +.. cfgcmd:: set firewall ipv6 name rule <1-999999> + recent time + + Match when the specified number of connections occur within the specified + time period. Use these criteria to block brute-force attempts. + +Packet Modifications +==================== + +The firewall can modify packets before sending them. +This feature provides more flexibility for packet handling. + +.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> + set dscp <0-63> +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + set dscp <0-63> +.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> + set dscp <0-63> + + Set a specific value of Differentiated Services Codepoint (DSCP). + +.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> + set mark <1-2147483647> +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + set mark <1-2147483647> +.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> + set mark <1-2147483647> + + Set a specific packet mark value. + +.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> + set tcp-mss <500-1460> +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + set tcp-mss <500-1460> +.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> + set tcp-mss <500-1460> + + Set the TCP-MSS (TCP maximum segment size) for the connection. + +.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> + set hop-limit <0-255> +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + set hop-limit <0-255> +.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> + set hop-limit <0-255> + + Set hop limit value. + +.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> + set connection-mark <0-2147483647> +.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> + set connection-mark <0-2147483647> + + Set connection mark value. + +******** +Synproxy +******** +Synproxy connections + +.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> + action synproxy +.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> + protocol tcp +.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> + synproxy tcp mss <501-65535> + + Set the TCP MSS (maximum segment size) for the connection. + +.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> + synproxy tcp window-scale <1-14> + + Set the window scale factor for TCP window scaling. + +Example synproxy +================ +Requirements to enable synproxy: + + * Traffic must be symmetric + * Synproxy relies on syncookies and TCP timestamps, ensure these are enabled + * Disable conntrack loose track option + +.. code-block:: none + + set system sysctl parameter net.ipv4.tcp_timestamps value '1' + + set system conntrack tcp loose disable + set system conntrack ignore ipv6 rule 10 destination port '8080' + set system conntrack ignore ipv6 rule 10 protocol 'tcp' + set system conntrack ignore ipv6 rule 10 tcp flags syn + + set firewall global-options syn-cookies 'enable' + set firewall ipv6 input filter rule 10 action 'synproxy' + set firewall ipv6 input filter rule 10 destination port '8080' + set firewall ipv6 input filter rule 10 inbound-interface name 'eth1' + set firewall ipv6 input filter rule 10 protocol 'tcp' + set firewall ipv6 input filter rule 10 synproxy tcp mss '1460' + set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7' + set firewall ipv6 input filter rule 1000 action 'drop' + set firewall ipv6 input filter rule 1000 state invalid + +*********************** +Operation-mode Firewall +*********************** + +Rule-set overview +================= + +.. opcmd:: show firewall + + Show a basic firewall overview for all rule-sets, not only for IPv6: + + .. code-block:: none + + vyos@vyos:~$ show firewall + Rulesets Information + + --------------------------------- + IPv4 Firewall "forward filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ----------------------------------------- + 5 jump all 0 0 iifname "eth1" jump NAME_VyOS_MANAGEMENT + 10 jump all 0 0 oifname "eth1" jump NAME_WAN_IN + 15 jump all 0 0 iifname "eth3" jump NAME_WAN_IN + default accept all + + --------------------------------- + IPv4 Firewall "name VyOS_MANAGEMENT" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- -------------------------------- + 5 accept all 0 0 ct state established accept + 10 drop all 0 0 ct state invalid + 20 accept all 0 0 ip saddr @A_GOOD_GUYS accept + 30 accept all 0 0 ip saddr @N_ENTIRE_RANGE accept + 40 accept all 0 0 ip saddr @A_VyOS_SERVERS accept + 50 accept icmp 0 0 meta l4proto icmp accept + default drop all 0 0 + + --------------------------------- + IPv6 Firewall "forward filter" + + Rule Action Protocol + ------- -------- ---------- + 5 jump all + 10 jump all + 15 jump all + default accept all + + --------------------------------- + IPv6 Firewall "input filter" + + Rule Action Protocol + ------- -------- ---------- + 5 jump all + default accept all + + --------------------------------- + IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT" + + Rule Action Protocol + ------- -------- ---------- + 5 accept all + 10 drop all + 20 accept all + 30 accept all + 40 accept all + 50 accept ipv6-icmp + default drop all + +.. opcmd:: show firewall summary + + This will show you a summary of rule-sets and groups + + .. code-block:: none + + vyos@vyos:~$ show firewall summary + Ruleset Summary + + IPv6 Ruleset: + + Ruleset Hook Ruleset Priority Description + -------------- -------------------- ------------------------- + forward filter + input filter + ipv6_name IPV6-VyOS_MANAGEMENT + ipv6_name IPV6-WAN_IN PUBLIC_INTERNET + + IPv4 Ruleset: + + Ruleset Hook Ruleset Priority Description + -------------- ------------------ ------------------------- + forward filter + input filter + name VyOS_MANAGEMENT + name WAN_IN PUBLIC_INTERNET + + Firewall Groups + + Name Type References Members + ----------------------- ------------------ ----------------------- ---------------- + PBX address_group WAN_IN-100 198.51.100.77 + SERVERS address_group WAN_IN-110 192.0.2.10 + WAN_IN-111 192.0.2.11 + WAN_IN-112 192.0.2.12 + WAN_IN-120 + WAN_IN-121 + WAN_IN-122 + SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 + WAN_IN-20 + PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 + PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2 + WAN_IN-171 + PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 + SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 + IPV6-WAN_IN-111 2001:db8::3 + IPV6-WAN_IN-112 2001:db8::4 + IPV6-WAN_IN-120 + IPV6-WAN_IN-121 + IPV6-WAN_IN-122 + SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 + IPV6-WAN_IN-20 + + +.. opcmd:: show firewall ipv6 [forward | input | output] filter + +.. opcmd:: show firewall ipv6 ipv6-name + + This command will give an overview of a single rule-set. + + .. code-block:: none + + vyos@vyos:~$ show firewall ipv6 input filter + Ruleset Information + + --------------------------------- + ipv6 Firewall "input filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ------------------------------------------------------------------------------ + 10 jump all 13 1456 iifname "eth1" jump NAME6_INP-ETH1 + 20 accept ipv6-icmp 10 1112 meta l4proto ipv6-icmp iifname "eth0" prefix "[ipv6-INP-filter-20-A]" accept + default accept all 14 1584 + + vyos@vyos:~$ + +.. opcmd:: show firewall ipv6 [forward | input | output] + filter rule <1-999999> + +.. opcmd:: show firewall ipv6 name rule <1-999999> + +.. opcmd:: show firewall ipv6 ipv6-name rule <1-999999> + + This command will give an overview of a rule in a single rule-set + +.. opcmd:: show firewall group + + Show an overview of defined groups, including the type, members, and where + the group is used. + + .. code-block:: none + + vyos@vyos:~$ show firewall group LAN + Firewall Groups + + Name Type References Members + ------------ ------------------ ----------------------- ---------------- + LAN ipv6_network_group IPV6-VyOS_MANAGEMENT-30 2001:db8::0/64 + IPV6-WAN_IN-30 + LAN network_group VyOS_MANAGEMENT-30 192.168.200.0/24 + WAN_IN-30 + + +.. opcmd:: show firewall statistics + + Show statistics of all rule-sets since the last boot. + +Show Firewall log +================= + +.. opcmd:: show log firewall +.. opcmd:: show log firewall ipv6 +.. opcmd:: show log firewall ipv6 [forward | input | output | name] +.. opcmd:: show log firewall ipv6 [forward | input | output] filter +.. opcmd:: show log firewall ipv6 name +.. opcmd:: show log firewall ipv6 [forward | input | output] filter rule +.. opcmd:: show log firewall ipv6 name rule + + Show firewall logs for all firewalls, all IPv6 firewalls, specific hooks, + specific priorities, specific custom chains, or specific rule-sets. + +Example Partial Config +====================== + +.. code-block:: none + + firewall { + ipv6 { + input { + filter { + rule 10 { + action jump + inbound-interface { + name eth1 + } + jump-target INP-ETH1 + } + rule 20 { + action accept + inbound-interface { + name eth0 + } + log + protocol ipv6-icmp + } + } + } + name INP-ETH1 { + default-action drop + default-log + rule 10 { + action accept + protocol tcp_udp + } + } + } + } + + +Update geoip database +===================== + +.. opcmd:: update geoip + + Command used to update GeoIP database and firewall sets. diff --git a/docs/configuration/firewall/rst-zone.rst b/docs/configuration/firewall/rst-zone.rst new file mode 100644 index 00000000..f3b12473 --- /dev/null +++ b/docs/configuration/firewall/rst-zone.rst @@ -0,0 +1,205 @@ +:lastproofread: 2026-03-30 + +.. _firewall-zone: + +################### +Zone-Based Firewall +################### + +******** +Overview +******** + +.. note:: + All VyOS versions built after 2023-10-22 (VyOS 1.4 and 1.5) support + this feature. + +This section provides information on firewall configuration for the +zone-based firewall. This section covers the following configuration +commands: + +.. cfgcmd:: set firewall zone ... + +To learn about the general traffic flow in VyOS firewalls, +see :doc:`Firewall `. + +.. code-block:: none + + - set firewall + * zone + - custom_zone_name + + ... + +In zone-based policy, you assign interfaces to zones and apply inspection +policy to traffic moving between zones. The firewall acts on traffic +according to rules. A zone is a group of interfaces that have similar +functions or features. It establishes the security borders of a network. +A zone defines a boundary where the system subjects traffic to policy +restrictions as it crosses to another region of a network. + +Key Points: + +* A zone must be configured before you assign an interface to it, and you + can assign an interface to only a single zone. +* All traffic to and from an interface within a zone flows freely. +* Existing policies affect all traffic between zones. +* Traffic cannot flow between a zone member interface and any interface that + is not a zone member. +* You must define 2 separate firewalls to define traffic: one for each + direction. + +.. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. + The zone configuration moved from ``zone-policy zone `` to ``firewall + zone ``. + +************* +Configuration +************* + +As an alternative to applying policy to an interface directly, you can +create a zone-based firewall to simplify configuration when multiple +interfaces belong to the same security zone. Instead of applying rule-sets +to interfaces, you apply them to source-destination zone pairs. + +You can find a basic introduction to zone-based firewalls in the +`VyOS Knowledge Base +`_, +and an example at :ref:`examples-zone-policy`. + +The following steps are required to create a zone-based firewall: + +1. Define both the source and destination zones +2. Define the rule-set +3. Apply the rule-set to the zones + +Define a Zone +============= + +To define a zone, set up either one with interfaces or as the local zone. + +.. cfgcmd:: set firewall zone interface + + Assign interfaces as a member of a zone. + + .. note:: + + * An interface can only be a member of one zone. + * You can have multiple interfaces in a zone. Traffic between + interfaces in the same zone follows the intra-zone-filtering + policy (allowed by default). + +.. cfgcmd:: set firewall zone local-zone + + Define the zone as the local zone for traffic that originates from or is + destined to the router itself. + + .. note:: + + * A local zone cannot have any member interfaces + * You cannot have multiple local zones + +.. cfgcmd:: set firewall zone default-action [drop | reject] + + Modify the zone default-action, which applies to traffic destined to this + zone that does not match any of the source zone rulesets applied. + +.. cfgcmd:: set firewall zone default-log + + Enable logging of packets that match this zone's default-action (disabled + by default). + +.. cfgcmd:: set firewall zone description + + Add a meaningful description. + +Defining a Rule-Set +============================= + +Zone-based firewall rule-sets define traffic from a *Source Zone* to a +*Destination Zone*. + +You create rule-sets as a custom firewall chain using the commands below +(refer to the firewall IPv4/IPv6 sections for the full syntax): + +* For :ref:`IPv4`: + ``set firewall ipv4 name ...`` +* For :ref:`IPv6`: + ``set firewall ipv6 name ...`` + +It is helpful to name the rule-sets in the format +``--`` to make them easily +identifiable. + +Applying a Rule-Set to a Zone +============================= + +After you define a rule-set, apply it to the source and destination zones. +The configuration syntax anchors to the destination zone, with each of the +source zone rule-sets listed against the destination. + +.. cfgcmd:: set firewall zone from + firewall name + +.. cfgcmd:: set firewall zone from + firewall ipv6-name + +You should create two rule-sets for each source-destination zone +pair. + +.. code-block:: none + + set firewall zone DMZ from LAN firewall name LAN-DMZ-v4 + set firewall zone LAN from DMZ firewall name DMZ-LAN-v4 + +Applying a Default Rule-Set to a Zone +===================================== + +When a destination zone shares a common rule-set for multiple source zones, +or when you require a complex set of default policies, you can apply an +optional default rule-set. The default rule-set applies to all zones that do +not have a rule-set configured as defined in +:ref:`IPv4` + +.. cfgcmd:: set firewall zone default-firewall name + + +.. cfgcmd:: set firewall zone default-firewall ipv6-name + + +************** +Operation-mode +************** + +.. opcmd:: show firewall zone-policy + + Display a basic summary of the zone configuration. + + .. code-block:: none + + vyos@vyos:~$ show firewall zone-policy + Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 + ------ ------------ ----------- --------------- --------------- + LAN eth1 WAN WAN-LAN-v4 + eth2 + LOCAL LOCAL LAN LAN-LOCAL-v4 + WAN WAN-LOCAL-v4 WAN-LOCAL-v6 + WAN eth3 LAN LAN-WAN-v4 + eth0 LOCAL LOCAL-WAN-v4 + +.. opcmd:: show firewall zone-policy zone + + Display a basic summary of a particular zone. + + .. code-block:: none + + vyos@vyos:~$ show firewall zone-policy zone WAN + Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 + ------ ------------ ----------- --------------- --------------- + WAN eth3 LAN LAN-WAN-v4 + eth0 LOCAL LOCAL-WAN-v4 + + vyos@vyos:~$ show firewall zone-policy zone LOCAL + Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 + ------ ------------ ----------- --------------- --------------- + LOCAL LOCAL LAN LAN-LOCAL-v4 + WAN WAN-LOCAL-v4 WAN-LOCAL-v6 diff --git a/docs/configuration/firewall/zone.md b/docs/configuration/firewall/zone.md new file mode 100644 index 00000000..bbb93993 --- /dev/null +++ b/docs/configuration/firewall/zone.md @@ -0,0 +1,201 @@ +--- +lastproofread: '2026-03-30' +--- + +(firewall-zone)= + +# Zone-Based Firewall + +## Overview + +:::{note} +All VyOS versions built after 2023-10-22 (VyOS 1.4 and 1.5) support +this feature. +::: + +This section provides information on firewall configuration for the +zone-based firewall. This section covers the following configuration +commands: + +```{cfgcmd} set firewall zone ... +``` + +To learn about the general traffic flow in VyOS firewalls, +see {doc}`Firewall `. + +```none +- set firewall + * zone + - custom_zone_name + + ... +``` + +In zone-based policy, you assign interfaces to zones and apply inspection +policy to traffic moving between zones. The firewall acts on traffic +according to rules. A zone is a group of interfaces that have similar +functions or features. It establishes the security borders of a network. +A zone defines a boundary where the system subjects traffic to policy +restrictions as it crosses to another region of a network. + +Key Points: +- A zone must be configured before you assign an interface to it, and you + can assign an interface to only a single zone. +- All traffic to and from an interface within a zone flows freely. +- Existing policies affect all traffic between zones. +- Traffic cannot flow between a zone member interface and any interface that + is not a zone member. +- You must define 2 separate firewalls to define traffic: one for each + direction. + +:::{note} +In {vytask}`T2199` the syntax of the zone configuration was changed. +The zone configuration moved from ``zone-policy zone `` to +``firewall zone ``. +::: + +## Configuration + +As an alternative to applying policy to an interface directly, you can +create a zone-based firewall to simplify configuration when multiple +interfaces belong to the same security zone. Instead of applying rule-sets +to interfaces, you apply them to source-destination zone pairs. + +You can find a basic introduction to zone-based firewalls in the +[VyOS Knowledge Base](https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall), +and an example at {ref}`examples-zone-policy`. + +The following steps are required to create a zone-based firewall: +1. Define both the source and destination zones +2. Define the rule-set +3. Apply the rule-set to the zones + +### Define a Zone + +To define a zone, set up either one with interfaces or as the local zone. + +```{cfgcmd} set firewall zone \ interface \ + +Assign interfaces as a member of a zone. + +:::{note} +* An interface can only be a member of one zone. +* You can have multiple interfaces in a zone. Traffic between +interfaces in the same zone follows the intra-zone-filtering +policy (allowed by default). +::: +``` + +```{cfgcmd} set firewall zone \ local-zone + +Define the zone as the local zone for traffic that originates from or is +destined to the router itself. + +:::{note} +* A local zone cannot have any member interfaces +* You cannot have multiple local zones +::: +``` + +```{cfgcmd} set firewall zone \ default-action [drop | reject] + +Modify the zone default-action, which applies to traffic destined to this +zone that does not match any of the source zone rulesets applied. +``` + +```{cfgcmd} set firewall zone \ default-log + +Enable logging of packets that match this zone's default-action (disabled +by default). +``` + +```{cfgcmd} set firewall zone \ description + +Add a meaningful description. +``` + +### Defining a Rule-Set + +Zone-based firewall rule-sets define traffic from a *Source Zone* to a +*Destination Zone*. + +You create rule-sets as a custom firewall chain using the commands below +(refer to the firewall IPv4/IPv6 sections for the full syntax): +- For {ref}`IPv4`: + `set firewall ipv4 name ...` +- For {ref}`IPv6`: + `set firewall ipv6 name ...` + +It is helpful to name the rule-sets in the format +`--` to make them easily +identifiable. + +### Applying a Rule-Set to a Zone + +After you define a rule-set, apply it to the source and destination zones. +The configuration syntax anchors to the destination zone, with each of the +source zone rule-sets listed against the destination. + +```{cfgcmd} set firewall zone \ from \ firewall name \ +``` + +```{cfgcmd} set firewall zone \ from \ firewall ipv6-name \ +``` + +You should create two rule-sets for each source-destination zone +pair. + +```none +set firewall zone DMZ from LAN firewall name LAN-DMZ-v4 +set firewall zone LAN from DMZ firewall name DMZ-LAN-v4 +``` + +### Applying a Default Rule-Set to a Zone + +When a destination zone shares a common rule-set for multiple source zones, +or when you require a complex set of default policies, you can apply an +optional default rule-set. The default rule-set applies to all zones that do +not have a rule-set configured as defined in +{ref}`IPv4` + +```{cfgcmd} set firewall zone \ default-firewall name \ +``` + +```{cfgcmd} set firewall zone \ default-firewall ipv6-name \ +``` + +## Operation-mode + +```{opcmd} show firewall zone-policy + +Display a basic summary of the zone configuration. + +:::{code-block} none +vyos@vyos:~$ show firewall zone-policy +Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 +------ ------------ ----------- --------------- --------------- +LAN eth1 WAN WAN-LAN-v4 +eth2 +LOCAL LOCAL LAN LAN-LOCAL-v4 +WAN WAN-LOCAL-v4 WAN-LOCAL-v6 +WAN eth3 LAN LAN-WAN-v4 +eth0 LOCAL LOCAL-WAN-v4 +::: +``` + +```{opcmd} show firewall zone-policy zone \ + +Display a basic summary of a particular zone. + +:::{code-block} none +vyos@vyos:~$ show firewall zone-policy zone WAN +Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 +------ ------------ ----------- --------------- --------------- +WAN eth3 LAN LAN-WAN-v4 +eth0 LOCAL LOCAL-WAN-v4 +vyos@vyos:~$ show firewall zone-policy zone LOCAL +Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 +------ ------------ ----------- --------------- --------------- +LOCAL LOCAL LAN LAN-LOCAL-v4 +WAN WAN-LOCAL-v4 WAN-LOCAL-v6 +::: +``` \ No newline at end of file diff --git a/docs/configuration/firewall/zone.rst b/docs/configuration/firewall/zone.rst deleted file mode 100644 index f3b12473..00000000 --- a/docs/configuration/firewall/zone.rst +++ /dev/null @@ -1,205 +0,0 @@ -:lastproofread: 2026-03-30 - -.. _firewall-zone: - -################### -Zone-Based Firewall -################### - -******** -Overview -******** - -.. note:: - All VyOS versions built after 2023-10-22 (VyOS 1.4 and 1.5) support - this feature. - -This section provides information on firewall configuration for the -zone-based firewall. This section covers the following configuration -commands: - -.. cfgcmd:: set firewall zone ... - -To learn about the general traffic flow in VyOS firewalls, -see :doc:`Firewall `. - -.. code-block:: none - - - set firewall - * zone - - custom_zone_name - + ... - -In zone-based policy, you assign interfaces to zones and apply inspection -policy to traffic moving between zones. The firewall acts on traffic -according to rules. A zone is a group of interfaces that have similar -functions or features. It establishes the security borders of a network. -A zone defines a boundary where the system subjects traffic to policy -restrictions as it crosses to another region of a network. - -Key Points: - -* A zone must be configured before you assign an interface to it, and you - can assign an interface to only a single zone. -* All traffic to and from an interface within a zone flows freely. -* Existing policies affect all traffic between zones. -* Traffic cannot flow between a zone member interface and any interface that - is not a zone member. -* You must define 2 separate firewalls to define traffic: one for each - direction. - -.. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. - The zone configuration moved from ``zone-policy zone `` to ``firewall - zone ``. - -************* -Configuration -************* - -As an alternative to applying policy to an interface directly, you can -create a zone-based firewall to simplify configuration when multiple -interfaces belong to the same security zone. Instead of applying rule-sets -to interfaces, you apply them to source-destination zone pairs. - -You can find a basic introduction to zone-based firewalls in the -`VyOS Knowledge Base -`_, -and an example at :ref:`examples-zone-policy`. - -The following steps are required to create a zone-based firewall: - -1. Define both the source and destination zones -2. Define the rule-set -3. Apply the rule-set to the zones - -Define a Zone -============= - -To define a zone, set up either one with interfaces or as the local zone. - -.. cfgcmd:: set firewall zone interface - - Assign interfaces as a member of a zone. - - .. note:: - - * An interface can only be a member of one zone. - * You can have multiple interfaces in a zone. Traffic between - interfaces in the same zone follows the intra-zone-filtering - policy (allowed by default). - -.. cfgcmd:: set firewall zone local-zone - - Define the zone as the local zone for traffic that originates from or is - destined to the router itself. - - .. note:: - - * A local zone cannot have any member interfaces - * You cannot have multiple local zones - -.. cfgcmd:: set firewall zone default-action [drop | reject] - - Modify the zone default-action, which applies to traffic destined to this - zone that does not match any of the source zone rulesets applied. - -.. cfgcmd:: set firewall zone default-log - - Enable logging of packets that match this zone's default-action (disabled - by default). - -.. cfgcmd:: set firewall zone description - - Add a meaningful description. - -Defining a Rule-Set -============================= - -Zone-based firewall rule-sets define traffic from a *Source Zone* to a -*Destination Zone*. - -You create rule-sets as a custom firewall chain using the commands below -(refer to the firewall IPv4/IPv6 sections for the full syntax): - -* For :ref:`IPv4`: - ``set firewall ipv4 name ...`` -* For :ref:`IPv6`: - ``set firewall ipv6 name ...`` - -It is helpful to name the rule-sets in the format -``--`` to make them easily -identifiable. - -Applying a Rule-Set to a Zone -============================= - -After you define a rule-set, apply it to the source and destination zones. -The configuration syntax anchors to the destination zone, with each of the -source zone rule-sets listed against the destination. - -.. cfgcmd:: set firewall zone from - firewall name - -.. cfgcmd:: set firewall zone from - firewall ipv6-name - -You should create two rule-sets for each source-destination zone -pair. - -.. code-block:: none - - set firewall zone DMZ from LAN firewall name LAN-DMZ-v4 - set firewall zone LAN from DMZ firewall name DMZ-LAN-v4 - -Applying a Default Rule-Set to a Zone -===================================== - -When a destination zone shares a common rule-set for multiple source zones, -or when you require a complex set of default policies, you can apply an -optional default rule-set. The default rule-set applies to all zones that do -not have a rule-set configured as defined in -:ref:`IPv4` - -.. cfgcmd:: set firewall zone default-firewall name - - -.. cfgcmd:: set firewall zone default-firewall ipv6-name - - -************** -Operation-mode -************** - -.. opcmd:: show firewall zone-policy - - Display a basic summary of the zone configuration. - - .. code-block:: none - - vyos@vyos:~$ show firewall zone-policy - Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 - ------ ------------ ----------- --------------- --------------- - LAN eth1 WAN WAN-LAN-v4 - eth2 - LOCAL LOCAL LAN LAN-LOCAL-v4 - WAN WAN-LOCAL-v4 WAN-LOCAL-v6 - WAN eth3 LAN LAN-WAN-v4 - eth0 LOCAL LOCAL-WAN-v4 - -.. opcmd:: show firewall zone-policy zone - - Display a basic summary of a particular zone. - - .. code-block:: none - - vyos@vyos:~$ show firewall zone-policy zone WAN - Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 - ------ ------------ ----------- --------------- --------------- - WAN eth3 LAN LAN-WAN-v4 - eth0 LOCAL LOCAL-WAN-v4 - - vyos@vyos:~$ show firewall zone-policy zone LOCAL - Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 - ------ ------------ ----------- --------------- --------------- - LOCAL LOCAL LAN LAN-LOCAL-v4 - WAN WAN-LOCAL-v4 WAN-LOCAL-v6 -- cgit v1.2.3